The Perl 5.006_00 source code contains (in doio.c):

for (s = cmd; *s; s++) {
    if (*s != ' ' && !isALPHA(*s) && strchr("$&*(){}[]'\";\\|?<>~`\n",
+*s)) {
        if (*s == '\n' && !s[1]) {
            *s = '\0';
            break;
        }
        /* handle the 2>&1 construct at the end */
        if (*s == '>' && s[1] == '&' && s[2] == '1'
            && s > cmd + 1 && s[-1] == '2' && isSPACE(s[-2])
            && (!s[3] || isSPACE(s[3])))
        {
            char *t = s + 3;

            while (*t && isSPACE(*t))
                ++t;
            if (!*t && (dup2(1,2) != -1)) {
                s[-2] = '\0';
                break;
            }
        }
      doshell:
        PerlProc_execl(PL_sh_path, "sh", "-c", cmd, (char*)0);
        return FALSE;
    }
}
[download]

So, when it is checking for shell meta characters, if it finds " 2>&1" at the end (without any shell meta characters before that) and if dup2(1,2) != -1, then it strips the " 2>&1" and avoids the shell.

                - tye