The comma? It’s a valid variable character (though one we could possibly deny as a literal name via a policy). This will still always work:
set(varname "foo,")
set("${varname}" value)
That said…maybe one shouldn’t use GLOB_RECURSE for source file listings 
. I, personally, would never recommend it.
That said, there are warnings for unused/undefined variables you can ask for upon request (--warn-unused and --warn-undefined).