The problem occurs in... This is very hard to detect through static analysis of source code; it's probably not especially easy to detect at run-time either.
Yes, I recognized that, but since PPI certainly detects $1 and s/// as $1 and substitution operator, I see no reason perlcritic couldn't do the same, it uses PPI
I also recognize the abilities of warnings/lint, they actually run the code and can detect this case as well -- sure it might be too much to ask from warnings (could be slow) , but its not too much to ask of lint :)