I've been testing the solutions posted so far along with my own. I post it here just for completeness since others are faster:

sub kyle {
    my ($s1, $s2) = @_;

    my $out = $s1;
    while ( $s1 =~ m/\000/g ) {
        my $pos = pos;
        substr( $out, $pos, 1 ) = substr( $s2, $pos, 1 );
    }

    return $out;
}
[download]

I changed the test script slightly so that it checks that the subs in question actually work (they do):

my $subs =  {
    'split1'     => sub { my $s3 = split1( $s1, $s2 ) },
    'substr1'    => sub { my $s3 = substr1( $s1, $s2 ) },
    'kyle'       => sub { my $s3 = kyle( $s1, $s2 ) },
    'moritz'     => sub { my $s3 = moritz( $s1, $s2 ) },
    'corion'     => sub { my $s3 = corion( $s1, $s2 ) },
    'ikegami_s'  => sub { my $s3 = ikegami_s( $s1, $s2 ) },
    'ikegami_tr' => sub { my $s3 = ikegami_tr( $s1, $s2 ) },
    'avar'       => sub { my $s3 = avar( $s1, $s2 ) },
};

cmpthese( -2, $subs );

use Test::More;

plan 'tests' => scalar keys %{$subs};

my $s3;
foreach my $subname ( keys %{$subs} ) {
    my $sub = $subs->{$subname};
    if ( defined $s3 ) {
        is( $sub->(), $s3, "$subname gets same value" );
    }
    else {
        $s3 = $sub->();
        ok( defined $s3, "$subname gets some value" );
    }
}
[download]

Since moritz didn't actually post code, I wrote something based on the suggestion:

sub moritz {
    my ($s1, $s2) = @_;

    my $pos = 0;
    while ( 0 < ( $pos = index $s1, "\000", $pos ) ) {
        substr( $s1, $pos, 1 ) = substr( $s2, $pos, 1 );
    }

    return $s1;
}
[download]

This was the fastest on my machine until avar posted a second version. (cmpthese lines truncated because they're so ugly.)

split1     5.94/s
substr1    41.3/s
ikegami_s  62.0/s
ikegami_tr 2111/s
corion     4342/s
kyle       5608/s
avar       5635/s
moritz     6305/s
avar2      6334/s
1..9
ok 1 - corion gets some value
ok 2 - substr1 gets same value
ok 3 - kyle gets same value
ok 4 - split1 gets same value
ok 5 - moritz gets same value
ok 6 - ikegami_tr gets same value
ok 7 - ikegami_s gets same value
ok 8 - avar gets same value
ok 9 - avar2 gets same value
[download]