The key point is that you can run arbitrary code (provided it parses) inside a regex match.

I have thought this too, but in fact I cannot make it happen for all my trying, and I have never seen any security advisories about it, nor kind I find any examples of such a thing.