Thanks for the kind words. :)

As a practical matter, I think your recommendations to end users regarding using special variables as arguments are sound advice. The same holds true for variables which are overloaded, tied, and so on. Partly this is because XS modules have options with regards to how they treat arguments, and it's hard to get everything right.

In this case, however, I believe that the problem is both contained and solvable. If I'm right, $1 should never have its SVf_POK flag set -- it will always have SVp_POK set, indicating that it has a valid "private pointer", but never the SVf_POK flag. From sv.h:

#define SVf_IOK         0x00000100  /* has valid public integer value 
+*/
#define SVf_NOK         0x00000200  /* has valid public numeric value 
+*/
#define SVf_POK         0x00000400  /* has valid public pointer value 
+*/
#define SVf_ROK         0x00000800  /* has a valid reference pointer *
+/

#define SVp_IOK         0x00001000  /* has valid non-public integer va
+lue */
#define SVp_NOK         0x00002000  /* has valid non-public numeric va
+lue */
#define SVp_POK         0x00004000  /* has valid non-public pointer va
+lue */
[download]

The task is thus to identify any such variables within Perl_sv_utf8_upgrade_flags_grow and ensure that the SVf_POK flag is off when the function returns. That can be achieved either by never turning it on in the first place, by turning it off at some point, or by throwing an exception.

It may actually be important to ensure that the flag never gets turned on. It's not clear to me that it's valid to call SvPV_force on $1. Should the attempt trigger a "modification of readonly value" exception?

The questions I would like answers to are,

• How are scalars with PERL_MAGIC_sv magic different from ordinary scalars?
• Are there any scalars other than the capture values which are assigned PERL_MAGIC_sv?
• Does every scalar with PERL_MAGIC_sv magic have the SVp_POK flag set?
• Can we use this "private" buffer in place of the standard string buffer for the purposes of Perl_sv_utf8_upgrade_flags_grow, and if so, are there any actions we need to take to ensure its safety?

Based on the answers to those questions, we should be able to come up with the proper incantation -- either at the beginning or near the end of the function -- to ensure that $1 leaves with its SVf_POK flag unset.