This line is confusing to me, my $md5 = md5_hex( do{ local( @ARGV, $/) = $file; <> } );

This bit: do{ local( @ARGV, $/) = $file; <> } reads the contents of the file whose name is $file.

By all means spread that out across multiple lines if you prefer; Or perhaps use File::Slurp.

I get "use of uninitialized value $_ in substitution (s///)

It is very hard to see how that could happen, given that $_ isn't referenced anywhere in the line that has the substitution operator?

why replacing the number with the md5 of that number is a poor idea?

Let's say you have file joe_1.jpg and you rename it to joe_c4ca4238a0b923820dcc509a6f75849b,jpg, then next week joe uploads a new photo and calls it joe_1.jpg. Different photo, but same name. Overwrite.

People tend to be very lazy and will likely stick to numbers if the low thousands, the potential for clashes is huge.

But even if all the images are tiny, say just 10k bytes, that means there are 2.3836626600959079364564032010142e+24660 possibilities.

Even with MD5 reducing that to 3.4028236692093846346337460743177e+38 the chances of collision are minuscule.