in reply to utf8::upgrade is untainting
It's not _surprising_ behaviour, though - it's hard to see how utf8::upgrade could do its job without a regex or 2...