Another, entirely different approach than using assertions, is to try an match your pattern using m//g in a while/for loop. It appears to work rather well. Note that I've changed the substitution string so that it's a different length from what it matched, just to make sure it does work.

$_ = 'abxy' x 15;
for(my $i = 0; m/ab/g and $i++<5;) {
    substr($_, $-[0], $+[0]-$-[0]) = 'ABC';
}
print;
[download]

Result: ABCxyABCxyABCxyABCxyABCxyabxyabxyabxyabxyabxyabxyabxyabxyabxyabxy

That looks about right to me.

Update: See my follow-up in another subthread, that in general, you need to set pos() whenever you change the original string before continueing searching.