If you're writing a rewrite rule to 'map' username-subdomains to directories, then you *will* have to take control over those usernames. They will have to be:
valid HTTP subdomain strings,
valid HTTP URL-strings, and
valid *nix filepath strings.
I strongly suggest that you accept *only* username strings containing lowercase letters, numbers, and hyphens, and further, that the username must start with a letter and end with a letter or a number. That will keep you out of trouble with the various protocol and filesystem requirements.
You can code the mod_rewrite accordingly, but the new-user sign-up script must enforce the "rules" above, so as not to allow creation of accounts that cannot be accessed.
[edited by: jdMorgan at 2:19 am (utc) on July 17, 2007]