Perfect. This is what I was expecting to see. Yes, non-lvalue functions copy their result.

$ perl -MDevel::Peek -e'Dump sub { my $x = "abc"; Dump $x; $x }->()'
SV = PV(0x8bfe730) at 0x8c1b2b0
  REFCNT = 1
  FLAGS = (PADMY,POK,pPOK)
  PV = 0x8c16088 "abc"\0           <-- Note the address
  CUR = 3
  LEN = 12
SV = PV(0x8bfe780) at 0x8c00768
  REFCNT = 1
  FLAGS = (TEMP,POK,pPOK)
  PV = 0x8c1e2e0 "abc"\0           <-- A copy
  CUR = 3
  LEN = 12
[download]

That's why returning a string ($ref = \out1()) is as expensive as assigning a string ($str = ${ out2() }).

So why is both returning a string and assigning it not ($str = out1()) twice as expensive?

When assigning a string slated to be destroyed* such as the automatic copy of a return value, the assignment will steal the buffer instead of copying it.

* — (FLAGS & TEMP) && REFCNT == 1, I think.