The first 'e' causes $str_regexp to be evaluated as Perl code. In other words, it uses the value of $str_regexp as the replacement string. That is compiled along with the rest of the program. There's no risk to this.

The second 'e' causes the content of $str_regexp to be evaluated as Perl code. Since that could have come from anywhere, this is very dangerous.