eval($s);
[download]

$ perl -e " $x = shift; /$x/" "(?{ die 666 })"
Eval-group not allowed at runtime, use re 'eval' in regex m/(?{ die 66
+6 })/ at -e line 1.

$ perl -Mre=eval -e " $x = shift; /$x/" "(?{ die 666 })"
666 at (re_eval 1) line 1.

$ perl -Mre=eval -Te " $x = shift; /$x/" "(?{ die 666 })"
Eval-group in insecure regular expression in regex m/(?{ die 666 })/ a
+t -e line 1.
[download]

syntax error at -e line 1, near "="
Execution of -e aborted due to compilation errors.
[download]

For all of those dude.

I did not mean it as a literal runnable example, or I would have put it in code tags.

The key point is that you can run arbitrary code (provided it parses) inside a regex match. If you allow user data into the regex match, then the sky is the limit for exploits. (As anonymonk shows above, Taint mode is smart enough to hate that sort of thing)

also there are regex patterns which will run forever, and there have been some that will overflowed buffers...

The key point is that you can run arbitrary code (provided it parses) inside a regex match.

I have thought this too, but in fact I cannot make it happen for all my trying, and I have never seen any security advisories about it, nor kind I find any examples of such a thing.