That font locking is actually a bug:

	     ("\\(\\([@%]\\|\\$#\\)[a-zA-Z_:][a-zA-Z0-9_:]*\\)" 1
	      (if (eq (char-after (match-beginning 2)) ?%)
		  'cperl-hash-face
		'cperl-array-face)
	      t)			; arrays and hashes

It's interpreting this as a hash called %d...  but we're inside a
string, so it's not a hash.

At this point, the string has already been fontised...  So how do we
avoid doing this stuff if we're in a string?  Cc'd Stefan for
expertise.  :-)

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no