It does accept anything since it do not start with ^ and ends with $
Here is a correct (and optimised) one :

^[a-zA-Z0-9]([a-zA-Z0-9-_\\.]*[a-zA-Z0-9])?$