Ah. Upon further study, there's nothing special about $_, it seems that any global or package variable that is bound to the original variable causes this.

## This code block causes problems
use vars qw/ $g /;   # or, "our $g;"
sub doit_local {
  local $g = shift;
  $g =~ s/'/'\''/g;
  return $g;
}

sub get_md5sums {
  my $x = shift;
  print Dumper [$x, $$x{path}];
  for $g ('find', $$x{path}, qw/-type f -exec md5sum {} ;/) {
    $$x{foo} .= '"'.doit_local($g).'"';
  }
  return 1;
}
[download]

However, it is not a problem if we make a copy first

## This code block works as expected
use vars qw/ $g /;   # or, "our $g;"
sub doit_local {
  local $g = shift;
  $g =~ s/'/'\''/g;
  return $g;
}

sub get_md5sums {
  my $x = shift;
  print Dumper [$x, $$x{path}];
  for ('find', $$x{path}, qw/-type f -exec md5sum {} ;/) {
    $g = $_;
    $$x{foo} .= '"'.doit_local($g).'"';
  }
  return 1;
}
[download]

I will write up some tests and report this using perlbug. Thanks a lot!