I am no pro with regexes but this is what I came up with for starters:
For files to hide: [iI][nN][dD][eE][xX]\.([hH][tT][mM][lL]?|[pP][hH][pP])|\..*
This should catch ANY hidden files/folders and files named index.php or index.htm(l). This should also be easily expandable to catch other potentially malicious extensions/scripts (perl, sh, ruby etc).
I would suggest to also use regexes for upload_reject_extension and hidden_dirs and maybe others I didn't consider.
Tested on http://rubular.com/ with teststring
.test/
.htpasswd
.htaccess
index.html
index.php
index.htm