Ron Rennick on "[Plugin: WordPress MU Domain Mapping] security issue with allowing users to map their own domains"

So a user can enter high ascii characters, unicode, leading dots, trailing dots, ip addresses, "localhost" and a whole bunch of other questionable entries that may cause undesired behavior.

Agreed - however that does not make it a security issue.