Hi,
use strict; is your friend. If you put it in front of your statements, you get something like

Global symbol "$hash" requires explicit package name at 710071.pl line
+ 5.
BEGIN not safe after errors--compilation aborted at 710071.pl line ...
[download]

This is because the first assignments assigns 'malay' to the hash %hash (with key 'ONE'), whereas the second tries to assign 'manab' to an anonymous hash that is referenced by the reference called $hash (that is not explicitely created and therefore errs with "strict" on).
That said, the second assignment does not add an key/value pair to your %hash!
Regards,
svenXY