Incidentally, if I substitute

(append $u)='Bar';
print $u;
[download]

with

print +(append 'Foo')='Bar';
[download]

it still works, whereas I would have expected it to raise an error about an attempt to modify a read-only value. Why doesn't it?

When you take a reference to a passed constant (e.g. \$_[0]), perl silently copies the constant and makes a reference to the copy instead, starting with 5.8.4/5.9.1. It's not clear to me that this was an intentional change. Simple test case:

perl -we'sub { print \$_[0]==\${\$_[0]}&&"no ","copy $]" }->("Bar")'
[download]

The copy takes place in the SvPADTMP case in pp.c:S_refto.

Update: I may be wrong about the versions; it is making a copy on all the threaded perls I have and not making a copy on unthreaded perls.