It's tainted because it's input from outside your script that's under the (dirty malicious) user's control which means that you can't presume anything about it.

$ mkdir /tmp/spoo
$ cd /tmp/spoo
$ mkdir "zomg ; rm -rf *"
$ ln -s "zomg ; rm -rf */" spoo
$ cd spoo
$ perl -MCwd -le 'print Cwd::abs_path'
/private/tmp/spoo/zomg ; rm -rf *
[download]