Now, tell us how the user is going to put in a (?{code}) construct if use re 'eval';
hasn't been enabled.
Now, running regexes supplied by a possible hostile user
can give problems - but the problems are not
the possibility of running arbitrary code; at least not
by default.