After more testing it seems the damage is done before perl evals the args, as the args include the files in that directory. I created a string in the perl script that has the files in the directory (Cwd) and once I detect that string in the args, rather that stripping that string I decided to turn the message into "I told you not to use asterisks". I'll see how that goes. Once spanked, I will just remove the dir listing from the string.
BTW They fork the perl script from the bash shell, testing for * like kennethk mentioned resulted in no asterisks ...