--- a/README.listtexts	Fri Apr 20 10:35:27 2012 +1000
+++ b/README.listtexts	Fri Apr 20 10:41:58 2012 +1000
@@ -341,13 +341,13 @@
 
 - %text T%
   text from the file named T in the listdir/text directory; the name may only
-  include letters, digits, underscore, dot and hyphen; note that there is an
-  unformatted version of this directive
+  include letters, digits, underscore, dot and hyphen, and may not start with a
+  dot; note that there is an unformatted version of this directive
 
 - %control C%
   the contents of the control file named C in listir/control; the name may only
-  include letters, digits, underscore, dot and hyphen; note that there is an
-  unformatted version of this directive
+  include letters, digits, underscore, dot and hyphen, and may not start with a
+  dot; note that there is an unformatted version of this directive
 
 - %originalmail%
 - %originalmail N%
@@ -418,7 +418,8 @@
 - $control C$
   the contents of the control file named C in listdir/control, with its final
   newline stripped; the name may only include letters, digits, underscore, dot
-  and hyphen; note that there is a formatted version of this directive
+  and hyphen, and may not start with a dot; note that there is a formatted
+  version of this directive
 
 - $digestfirst$
   (available only in digest)
@@ -562,7 +563,8 @@
 - $text T$
   text from the file named T in the listdir/text directory, with its final
   newline stripped; the name may only include letters, digits, underscore, dot
-  and hyphen; note that there is a formatted version of this directive
+  and hyphen, and may not start with a dot; note that there is a formatted
+  version of this directive
 
 Escapes
 -------

--- a/src/prepstdreply.c	Fri Apr 20 10:35:27 2012 +1000
+++ b/src/prepstdreply.c	Fri Apr 20 10:41:58 2012 +1000
@@ -298,14 +298,14 @@
 
 static char *filename_token(char *token)
 {
-	char *pos;
-	if (*token == '\0') return NULL;
-	pos = token;
+	char *pos = token;
+	if (*pos == '\0') return NULL;
 	while (
 		(*pos >= '0' && *pos <= '9') ||
 		(*pos >= 'A' && *pos <= 'Z') ||
 		(*pos >= 'a' && *pos <= 'z') ||
-		(*pos == '_') || (*pos == '-') || (*pos == '.')
+		(*pos == '_') || (*pos == '-') ||
+		(*pos == '.' && pos != token)
 	) {
 		pos++;
 	}
@@ -736,18 +736,17 @@
 	conditional *cond;
 
 	if (txt->skip == NULL) {
+		for (;;) {
 		pos = token;
-		for (;;) {
-			if (*token == '\0') break;
-			for (; *pos != '\0' && (!multi || *pos != ' ');
-					pos++) {
-				if(*pos >= '0' && *pos <= '9') continue;
-				if(*pos >= 'A' && *pos <= 'Z') continue;
-				if(*pos >= 'a' && *pos <= 'z') continue;
-				if(*pos == '_') continue;
-				if(*pos == '-') continue;
-				if(*pos == '.') continue;
-				break;
+			if (*pos == '\0') break;
+			while (
+				(*pos >= '0' && *pos <= '9') ||
+				(*pos >= 'A' && *pos <= 'Z') ||
+				(*pos >= 'a' && *pos <= 'z') ||
+				(*pos == '_') || (*pos == '-') ||
+				(*pos == '.' && pos != token)
+			) {
+				pos++;
 			}
 			if (*pos == ' ') {
 				*pos = '\0';
@@ -780,7 +779,7 @@
 
 			if (!multi) break;
 			*pos = ' ';
-			pos++;
+			token = pos + 1;
 		}
 	} else {
 		/* We consider nested conditionals as successful while skipping