I wouldn't do that. You are untainting something that should not, IMO, be untainted. Consider an if statement and call the darn method from there. You are definitely asking for trouble with this code.

All someone would have to do is return

'NewDocument($refname);unlink(*);'
[download]

and you would wish you hadn't used this shortcut.

Update: Indeed, as noted below, you can only use letters, numbers, and _ or your regex will cast it out like so many demons. Still, there would seem to me to be just a little too much room for an exploit here. IMO, of course.