Like I already discussed, avoiding string-eval is for when input comes from untrusted sources. For example, a module loaded by (hopefully tainted) data read from the internet via a form submission. There, the user can't create a module of their own devising on my local machine but still could run arbitrary code with your method. I know that the variant I propose is propably overkill, as I already said above, but on the other hand, it isn't much more code and will land in a subroutine anyway, if such a feature is needed but not provided by any of the *::Plugin modules.