I thought that too but then I did an experiment and found that an unlink() with a relative path was not seen as an insecure dependancy under 5.8.6.

Note also that the dependancy is not on $ENV{PWD} but on the actual current directory that is something else.