Your premise appears to be that loading the module in order to obtain it's $VERSION is inherently unsafe; and you are attempting to reimplement some subset of the perl parser in order to avoid that "risk"; but if your module library is compromised enough that the risk of loading the modules it contains is real, how are you going to cater for the risk that your module is the one that has been compromised?

Further, what is the point in determining a module's $VERSION safely, when to use that module, you will need to load it? At which point it's version would be available to you, but you would of course have exposed yourself to the risk of it's being evaluated.

The only useful, non-paranoia uses I can see for this, would be: a) scanning the entire installed library and obtaining the versions of all the modules without ending up with them all loaded in your process; or b) risking 'collisions' between modules by loading them all simultaneously; but that would more easily be done by spawning one-liners that load the modules and print their $VERSION thereby isolating each from the next.

my @allmodules = map{ ... } @INC;
...
for my $module ( @allmodules ) {
    print "$module :", `perl -M$module le"\$${module}::VERSION"`;
}
[download]

I agree with Schwern.