You've misunderstood. A stringified reference isn't a reference anymore which means your keys %{$a} after altering the string is entirely meaningless. What you really said was to retrieve the keys from the hash named (approximately) 'HASH(0x12345)' which would lookl like my %HASH(0x12345) if that were valid perl code. In effect you're just exercising symbolic references without realizing it. There's absolutely no magic to a string that looks like "ARRAY(0x12345)". It means *nothing* (well it does but you don't normally care) to you except that the specific 'thing' located at the address 0x12345 is an array. The issue is you somehow thought that altering the string representation of a reference actually changes something about the reference. It doesn't - you actually threw the reference away during your process. Somewhat like taking a picture, altering the negative to include your friend in the picture doesn't actually mean your friend *is* in the picture. You might try using Data::Dumper on the reference prior to your s/// op and then after. You'll notice that you stomped all over it and turned it into something entirely different (just a string)

__SIG__
use B;
printf "You are here %08x\n", unpack "L!", unpack "P4", pack
  "L!", B::svref_2object(sub{})->OUTSIDE;
[download]