"Since that regex isn't doing any captures he should be safe" is wrong. Captures or not, $2 is cleared on a successful match.

$cfm = 'moo';
'moo' =~ /()(.*)/;

if (($2 =~ /css/i) || ($2 eq $cfm)) {
  print(defined($2)?1:0, $/);             # 1, cause match failed
  $uniques{$2}++;
}

'css' =~ /()(.*)/;

if (($2 =~ /css/i) || ($2 eq $cfm)) {
  print(defined($2)?1:0, $/);             # 0, cause match succeeded
  $uniques{$2}++;                         # $uniques{undef} ???
}
[download]