Complexity of :matches ?

Hello,

I just had a user using a wildcard pattern that took a large amount of
CPU time.  Now that this particular problem is solved, I wonder about
":matches".

Does anybody know the complexity order of recognising wildcard patterns,
which are a subset of regular expressions? Is giving users control of
patterns to be matched a security risk?

Michael