Did you check if $to_write is tainted? You can check with tainted (and even with Dump).

Or perhaps the module is making a new variable from yours which is tainted? Maybe it's not related to the file name at all. Did you isolate which variable is tainted in IO::File?

Or maybe the module causes IO::File to use the two arg form of open which checks $ENV{PATH} (and others?) for taintedness? What's that line 70 of your IO::File?