You can construct character classes (and negated character classes) based on backreferences on the fly with the (??{ .... }) regexp subexpression. Here's an example:

use strict;
use warnings;


my $string = "that bab";


print "Match: $1 => $2" 
    if $string =~ m/(that).+((??{ '[' . $1 . ']' }))/;

__OUTPUT__
Match: that => a
[download]

The above example matches 'that', and then uses the characters in 'that' as characters in a character class constructed within the (??{...}) subexpression. Since 'a' was one of the characters within 'that', it is matched, and captured into $2.

This gets a little tripped up if the first character held in the backreference is also a character class metacharacter, such as ^ (which would construct a negated character class), or if there is an embedded hyphen, which would attempt to construct a range, as in 'a-z'. And be careful with embedded backslashes because within a character class they might look like '\d' (the combination used for matching any digit character. So this technique is somewhat sensitive to the type of data you're looking at, but with reasonably sanitary strings it can be effective.