Hm. That could be said about any code that relies upon the use of symbolic references. Perl's symbol tables are hashes, and using a symbolic reference is simply looking up the 'name' in a one of those hashes.

But still, the primary argument against using symbolic references hold true. If someone sends you a correctly formed cmd message that contains a cmd that coincides with a method name that is not a part of the interface, that private method could be invoked by a third party.

I appreciate that you suggested in your comments that received command could be sanatised against a list of those that are a legitimate part of the interface, but the same could be done for any symbolic reference usage.

I guess it just reenforces the idea that best practices and even cardinal rules are just guidlines who's purpose should be to suggest caution, not to prohibit absolutely.

Upshot: I agree with you that this would be a far better way of implementing this requirement.