This issue has been raised while working on SKINFACTORY-43. Directories like CVS can be choosen as a possible variant parameter value but it should not..
I guess a mecanism that filters invalid value should be implemented in the VariantParameter#getDefaultValue methods, but a rule to determine invalid entries must be defined first (manual filtering on names like CVS? or examining child files as done in ImageParameter...)