I'm actually thinking that it IS safer to use SvPVX to get the buffer, so that I don't promote it 'by accident'.

I agree that using SvPVX in this context is better practice. If you haven't allocated memory for the string, SvPVX will attempt to dereference a struct member that isn't there, and segfault*. If you haven't both allocated memory and made the string POK, SvPV_nolen will return a buffer that's not writeable, and you'll get a segfault when you try to write to it*.

perlapi seems to suggest that SvPV_nolen is safer. That is not true for this usage, and putting it in there lends a false sense of security. Better to use SvPVX -- so it's clear that you're working without a net.

* If you're lucky. In general, Valgrind is extremely helpful for detecting these kinds of problems, and I strongly recommend it. Sadly, I don't think it will help in this specific case, because it's Linux-only (there's also a FreeBSD variant, but it doesn't seem to work with Perl).