I think we may safely assume that strict does not contain bugs. Small comfort indeed.

What about trying

    my $filename = $req->param("filename");
    my ($localfilename) =
        ($filename =~ m/(?:.*?$CGI::SL)*(.*)(?=$)/);
[download]

Otherwise, no, I don't see it...