In this case, you could also use s///ee (double eval).

my $line = 'The quick <CM>HTMLINSERT:<img src="grab me!"></CM> brown f
+ox';
my $key  = '<CM>HTMLINSERT:<img src=([^>]+)></CM>';
my %fsr_hash;
$fsr_hash{$key} = '"<figure><graphic url=$1/></figure></p>"';

$line =~ s/$key/$fsr_hash{$key}/gee;

print "$line\n";
[download]

___

$ ./701504.pl
The quick <figure><graphic url="grab me!"/></figure></p> brown fox
[download]

Unless I've overlooked something (which I'm sure someone would point out :), the usual worries about possibly executing arbitrary Perl code do not apply here, because whatever user input is in $1, despite the double eval it won't be evaluated — i.e. something like ... src=@{[...some evil code...]} ... in the input, will just produce

The quick <figure><graphic url=@{[...some evil code...]}/></figure></p
+> brown fox
[download]

(Of course, allowing arbitrary HTML code to be included could also be problematic... but that's another issue...)