Remember qw() is a compile time construct. But yes, if you're not sure about the pedigree of the contents of the file you don't want to pass a single scalar to system.

Update: Not to mention that qw() is equivalent to split(' ', q/STRING/) to begin with and hence wouldn't do any interpolation.