...
The three-argument invocations of open() are not subject to the same vulnerabilities as the two-argument open(). In this code $filename is treated as a file name, even if it contains characters that are treated specially by the two-argument open() function. For example, if $filename is specified as {} -, then the three-argument open() attempts to open a file name {}-, rather than opening standard input.
...