Beware this could have a huge security hole if you are taking method names from the user like that -- they can include a qualifying package name (normally you see SUPER:: used in this context, but it could be anything loaded).

In your example not so much, but if the params to that call were also under the user's control. Say IO::File was loaded and I went to 'do=IO::File::open', I might be able to read/write files.