You're right, some validation is definitely needed here... I'll start by checking whether the module name is a string.
However, checking whether the string specifies a valid (subdir) path isn't that trivial apparently, e.g. see http://stackoverflow.com/questions/9532499/check-whether-a-path-is-valid-in-python-without-creating-a-file-at-the-paths-ta...