User-defined URLs should not be used as regular expressions without being sanitized - which is ironically the kind of thing Nikto is looking for in the first place.  :-)  Without this change, a URL like '/[blah.txt' would cause a crash due to the URL itself being an invalid regular expression pattern.  Tyler Farr assisted with finding this problem and devising a fix.