For your implementation of BrowserUK's solution, you forgot the local line that's needed to hide the variables:

{ package safezone;
  local $a;
  sub eval_it {
    eval shift;
  }
}
[download]

Of course since you need a declaration for all variables you want to hide, this can get cumbersome rather quickly, but it does work

Update: This blows up with a Can't localize lexical variable $a at x line 12. Using my $a instead of local $a does seem to work here though.