... the module has strict and warnings turned on. So it is strange that the dereference isn't throwing an error or warning.

strict and warnings both support lexical scoping, so it's possible that strict has been locally disabled.

(And it's good to know the version of Perl you're using! :)