I don't fully get you. Do you mean untrusted regex or untrusted data it operates on?

And to be honest, even if the regex is trusted (came from a developer) and the data as well (something predictable and structured) we are still not protected from the developer using extremely stupid regex and breaking everything