From the JSLint documentation :
They correspond to more material than might be expected, allowing attackers to confuse applications. These forms should not be used for validation in secure applications.
This seems to be based on the specific philosophy of what you allow, rather than allowing anything (including multibyte and non-printable characters) with . or allow anything other than x, y and z (as [^…] means)
From the JSLint mailing list :
The rationale for this is that some people do not understand that . and [^...] mean in regular expressions, so it forces their code to either accept something as valid when it is not, or reject what is valid.