Spaces break the query interface (fixed with Ohad's patch, below) but dash is still reserved:
gethosts({"fact"=>{"productname"=>"Not Specified"}})
- returns a host count
gethosts({"fact"=>{"ps"=>"ps -ef"}})
- returns a 500 error, generates a url like "http://puppet:3000/hosts/query?fact[]=ps-ps%20-ef&&format=yml"

Even with fixed regex there is still no way to query for fact "foo-bar", esp if there is also a fact "foo".