Algorithm::AhoCorasick::XS versions through 0.04 for Perl contain a vulnerability where the haystack string length is read before the scalar is properly stringified. This can cause an out-of-bounds read leading to process aborts when the input is a numeric value or a reference. The issue arises due to the unspecified evaluation order of arguments in the std::string constructor, causing the length macro to run before stringification. This affects methods like matches, first_match, and match_details when processing non-string inputs such as numbers or blessed objects.