I suppose preg_match(), previously popularly opposed on performance grounds, it now arguably better than a straight string comparison in security terms due to probable timing attack resistance. :)
Regular expressions will exhibit the same behavior. They will also short circuit if no match is possible/ In essence the behavior that causes the problem is a desirable performance optimization for the general case that you just need to prevent here.
Doesn't it have to exhibit "correctly matching strings return faster ... on a per-character or other tiny chunk basis" in order to work the match towards correctness?
Yes, and it will indeed try by all means to exhibit that behavior -- unless if it's some contrived regex designed to counter this.
The key word here is "short cirtuit" the match, and any regex engine worth its salt will try to do that as much as possible, tranforming the regex to the faster FSM it can.