The bug is in the file wp-includes/theme.php. There are two places in that file where you can find this string:
'|[^a-z0-9_.-/]|i'
To fix this problem, change both of them to:
'|[^a-z0-9_./-]|i'
(The only difference is the location of the hyphen character).
