It hasn't to be user input. It could be the result of a File::Find::find run in a directory where some malicious Windows user created a directory name with whitespace in it.