To make merlyn happy:

Why not just keep using eval, but validate your $usr_str?

die "horribly" if $usr_str !~ /^(\{\w+\})+\z/;
my $val = eval "\$xml->$usr_str";
print $val;
[download]

If you do change to parsing out string keys and looping through them, which is really easy to do as others have demonstrated, be aware that some things will actually work differently, e.g. $usr_str = "{0x2a}{052}", which with eval is equivalent to {42}{42}.