EDIT:
Oops, just looked through the commit. Seems like the domain string is passed straight into the regex:
regexp = Regexp.new("@(.+\.)?(#{domains})", true)
Not sure if #{domains} gets sanitized before-hand. Unlikely because of the line:
domains = setting.gsub('.', '\.')
which only sanitizes the dot.
But it does appear to support putting a regex inside #{domains}, except that the regex cannot use the dot .