To further support ikegami's correct explanation, have a look at the following adaptation on your code:

use strict;
use warnings;

my $s1 = "abc";
my $s2 = "abc";
$s1 =~ s/.*/t/;
$s2 =~ s/(?{print pos(), qq!\n!}).*/t/g;
print "$s1\n$s2\n";
[download]

And the output,

0
3
3
t
tt
[download]

On the first pass, the position pointer is at 0, and .* greedily matches 'abc'. On the next pass the pointer is at position 3 (the end of the string has been reached) .* matches nothing, which is also legal. The third pass finds that the position pointer cannot be advanced further (still at 3), and fails immediately, ending the /g loop.