Some code inspection finally convinced me that this particular change from 5.8.6 to 5.8.7 was indeed not intentional. I have filed a bug report ([perl #38709]) complete with a patch and some testing code.

Funny that this has not been noticed sooner. Maybe it hasn't hurt too many people, since opening '|-' will be followed by exec as a rule, in which case one does have to untaint %ENV{PATH} at some point.

This is one more occasion I really appreciate Perl being Open Source.