Every compiler and interpreter as well as all text formats like HTML, XML, JSON, etc. have a lexing pass that uses manually crafted regular expressions. Those are real world projects.
The defensible form of this argument is that one should prefer a serialization library or a properly normalized database rather than trying to "stringly type" data and then pull it out via regexes.
I've read this a lot but I've yet to encounter bugs in regexes that wouldn't be otherwise encountered in a parser or validator that uses other techniques. Code is just code.
The defensible form of this argument is that one should prefer a serialization library or a properly normalized database rather than trying to "stringly type" data and then pull it out via regexes.