and it works just as well if you assign to a hashref rather than a hash.

There is a difference in the return value of Vars().
If you request a hash this is obviously a copy of the param hash of the CGI object.
If you request a a scalar you'll get a hashref, which is a variable tied to the CGI object, where the STORE/FETCH are implemented via the param() method of the CGI object.

The latter has some implications if you ever decide to assign to that hashref. Since the FETCH is implemented with a join("\0", $cgi->param('x')); (for cgilib compatible multi-value parameter handling), assigning refs to the hashref will lead to confusing results (due to the forced stringification on reading):

use CGI;
use Data::Dumper;
use strict;

my $q = CGI->new;

$q->param('form', 1 .. 5);

my $h = $q->Vars();

$h->{'form'} = [ 4 .. 6 ];

print Dumper($h, $q);
[download]