Were you able to find a way to supply wildcard reply URLs? In the new App registrations page, it is not possible to add wildcards, so I guess this is not really supported.
Update: I kept searching and found this:
4.1.5. Threat: Open Redirectors on Client
An open redirector is an endpoint using a parameter to automatically redirect a user agent to the location specified by the parameter value without any validation. If the authorization server allows the client to register only part of the redirect URI, an attacker can use an open redirector operated by the client to construct a redirect URI that will pass the authorization server validation but will send the authorization "code" or access token to an endpoint under the control of the attacker.
Impact: An attacker could gain access to authorization "codes" or access tokens.