Just use Regexp#source instead of hacky to_s. Check Regex pattern for NULL bytes

lib/mongo/util/bson_ruby.rb

@@ -451,8 +451,10 @@ class BSON_RUBY
     buf.put(REGEX)
     self.class.serialize_key(buf, key)
 
-    str = val.to_s.sub(/.*?:/, '')[0..-2] # Turn "(?xxx:yyy)" into "yyy"
-    self.class.serialize_cstr(buf, str)
+    str = val.source
+    # We use serialize_key here since regex patterns aren't prefixed with
+    # length (can't contain the NULL byte).
+    self.class.serialize_key(buf, str)
 
     options = val.options
     options_str = ''

test/test_bson.rb

@@ -329,6 +329,10 @@ class BSONTest < Test::Unit::TestCase
     assert_raise InvalidDocument do
       BSON.serialize({"\x00" => "a"})
     end
+
+    assert_raise InvalidDocument do
+      BSON.serialize({"a" => (Regexp.compile "ab\x00c")})
+    end
   end
 
 end