We can change the separator, but I don't think it would cause troubles. On memcache they are not supported, and redis doesn't seem to support too, only a special syntax for matching: http://redis.io/commands/keys.

About the vulnerability I don't I understood what you mean.