Don't you think you should have the user supply a pattern and a replacement as two separate arguments, and then plug them into s/// yourself (which would not require an eval)? What you're really doing is allowing the user to insert any code at all.
Caution: Contents may have been coded under pressure.