I figured you had a version that actually did work. FWIW, this is the only thing I could come up with that is as fast as the substitution. Unfortunately, it slows down when you put in the check for legit hex values (and it is much less readable).

sub noregex {
    local $_ = $str;

    my $pos = 0;
    while ( (my $idx = index($_, '%', $pos)) > -1) {
        $pos = $idx + 1;
        my $code = substr($_, $pos, 2);
        substr $_, $idx, 3, pack("C*", hex $code);
    }
    return $_;
}
__END__

Benchmark: timing 100000 iterations of NO_REGEX, REGEX...
  NO_REGEX:  8 wallclock secs ( 8.77 usr +  0.00 sys =  8.77 CPU) @ 11
+402.51/s (n=100000)
     REGEX:  9 wallclock secs ( 9.15 usr +  0.00 sys =  9.15 CPU) @ 10
+928.96/s (n=100000)
[download]