Pre-5.6 glob forks a shell and lets csh do the filename expansion. Allowing users to pass arbitrary strings to the shell is a Bad Thing, especially when you're running as root.

5.6, however, implements glob internally through File::Glob, so it's a lot safer (though that feature is currently labelled "experimental").

Update: This snippet from perlop should make it clear what is going on with glob on pre-5.6 Perl:

while (<*.c>) {
        chmod 0644, $_;
    }

is equivalent to

    open(FOO, "echo *.c | tr -s ' \t\r\f' '\\012\\012\\012\\012'|");
    while (<FOO>) {
        chop;
        chmod 0644, $_;
    }

In fact, it's currently implemented that way.  (Which
means it will not work on filenames with spaces in them
unless you have csh(1) on your machine.)
[download]