The latest official release of CPAN.pm, version 1.9205, contains a null byte in its source file.
I am somewhat surprised that perl doesn't trip over it, as there have been far more innocuous things that have made it stumble in the past, like line endings of another platform (Mac/Unix).
In case you're wondering: it's in sub CPAN::Shell::recent, at the start of the line with contents (that appear in the source only once):
$desc =~ s/.+? -
p.s. It still is there in the latest developer release (1.92_57).