> Thumbnails.php*album=*[0-9]* matches
> thumnails.php?album=topn... 
> 
> The *[0-9] matches nothing and the last asterisk
> matches the topn.  
> 
> The manual says * matches 0 or more.  

That's irrelevant. What's relevant is if *[0-9] matches 0 characters (which
would be stupid since then it would always match and it would be pointless).
If *[0-9] requires there to be at least one digit (in the range 0-9) then it
should follow that x*[0-9]* matches x followed by at least one digit.

> If you want album=999 you need *album=*[0-9] 

Why would that work if *[0-9] matches 0 characters? Then *album*[0-9] would
match the "album=" part of "album=foo", right?