As the API doc mentioned:
The name for a BasicPermission is the name of the given permission (for example, "exit", "setFactory", "print.queueJob", etc). The naming convention follows the hierarchical property naming convention. An asterisk may appear by itself, or if immediately preceded by a "." may appear at the end of the name, to signify a wildcard match. For example, "*" and "java.*" are valid, while "*java", "a*b", and "java*" are not valid.


The following is a testing class:
*********************************************
import java.lang.RuntimePermission;
import java.io.PrintStream;
import java.io.IOException;
import java.io.StringReader;
import java.io.StreamTokenizer;
import java.security.*;

public class qq {
    public qq (){}
    public static void main(String args[]) {
        BasicPermission s = new RuntimePermission ("hg*", "");
        BasicPermission d = new RuntimePermission ("*hg*", "");
        System.out.println("Here");
    }
}
****************************************

As the result shown, there will not be any exception or error, or even a warning being thrown to let the customers know that they use an invalid name. The class RuntimePermission (which extends BasicPermission) doesn't do anything for invalid name cases.

Should be consistent with the documentation.