There are some side-effects of current implementation of hostname wildcards in vhost middleware. It dynamically creates a RegExp by replacing the star but leaves other special characters intact.
I assume that this behavior is not expected (e.g. "dot" should match "dot", not any character). Escaping all RegExp special characters (or easier - all non-alphanumeric characters) should solve the problem.
don't accept RegExp grammar in vhost's hostname