Ah, I just found a way! Wrapping the metacharacters in a character class prevents the meta-character confusion:

warn Dumper extract_tagged(
  '[*][*]'
  '[*][*]'
);
[download]

Spits out

$VAR1 = '**bold words**';
$VAR2 = '';
$VAR3 = '';
$VAR4 = '**';
$VAR5 = 'bold words';
$VAR6 = '**';
[download]

as it's supposed to. Still, if someone has got a better way to do it, I'd be happy to hear it.