Actually, there is a hash. Would perl lie to you? May the heavens prevent such a day...
Okay, so I'm sick. I like to peek under the skirts of perl (holy blasphemy? erotic mysticism?) I d'led your code and parsed the hash. For ease of eye, I used Data::Dumper:
$VAR1 = bless( {
'.header_printed' => '1',
'.charset' => 'ISO-8859-1',
'.parameters' => [],
'.fieldnames' => {}
}, 'CGI' );
To me this says that somehow $sid became a reference to the object... as Juerd said below. So looking at the type that Juerd found, does anyone know what really happened here? $sid was assigned the value of $cgi, right? But what happened internally when fuzz tried to use the '=>' operator on it? Did it just say "no way, man... I don't know how to do that - I'm just giving you my data"?