I just tried it on a machine with perl 5.6 and it works fine. Must be an old bug. Upgrading isn't an option at this time so I'll have to untaint it with /(.*)/ after the first regexp.

Thanks.