I don't know if it is a bug in strict or not but you need to check to make sure that the match works before assigning $2 to anything. If the match fails then $localfilename will be empty and the open will fail.

Something like

my $localfilename;
if($filename =~ m/(.*?$CGI::SL)*(.*)(?=$)/ )
{
   $localfilename = $2;
}
else
{
   # handle the error however you need to
}
[download]