You would be better served to parse that, and then do the loop, rather than just evaling arbitrary strings that may include Bobby Tables, or rm -rf *

I suggest a series of simple regex:

1. Remove everything that is not a digit, a comma or a '..'
2. clean up leading/trailing commas and multiple commas in a row
3. Validate (everything should in the expected form (number {comma or EOS}, or number dot-dot number {comma or EOS})
4. split on commas
5. For each item in the split, capture some digits followed by an optional '..' with more captured digits afterwards
6. If there wasn't a '..', then just print $1, other wise, print $_ for $1..$2