Obviously a dash is permitted -- we're using that below.  And so is a period, as long as there isn't more than one in a row, and that it's not first.  (It can't be last, because we're appending to it.)  I also believe that non-ascii characters are also supported, and I think there are presumably tests for this in the email code.  So I'm more worried about characters that should not be allowed, like '@' at the very least.  But as you point out, it may be that it's not be permitted in a URL anyway.