print is an innocent bystander here. No string passed to print will cause rm to execute. The `...` operator is being executed while building the string to pass to print. You could remove the print and you would get the same result. 

> perl -Te "print qq{$var{die()}}"
Died at -e line 1.
> perl -Te "qq{$var{die()}}"
Died at -e line 1.

[download]

A string literal (as opposed to a string) is a form of code. In fact, quotes, qq and the other string literal delimiters are listed as operators in perlop. Like other operators, the compiler (perl or eval EXPR) is required to convert them and their operands into executable form. String literal are only string literals in the context of source code, and will not get executed unless they are first compiled.

Most string literals result in code that simply returns a constant string ("Hello World!\n") or in code that performs concatenation ("Hello $name!\n"). However, it is well known that string literals can excute arbitrary code using the reference-dereference-array trick you mentioned. There are other ways. 

perl -e "print qq{... @{[ ...arbitrary Perl expr... ]} ...}"
perl -e "print qq{... ${ ...arbitrary Perl expr... } ...}"
perl -e "print qq{... $var{ ...arbitrary Perl expr... } ...}"
perl -e "print qq{... $var[ ...arbitrary Perl expr... ] ...}"

[download]

I wouldn't call this a new security hole, since eval is needed to exploit it.

Updated for readability and clarity, but no changes were made to the substance of the post.

In reply to Re: How to delete a file with a print statement by ikegami
in thread How to delete a file with a print statement by Ovid

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.