I understand why "index.php" is not broken up: the <URL> rule matches "index.ph", but the <ALPHANUM> rule has a longer match, so it wins.
Conversely, <ALPHANUM> does not match "index2.php" (likely because the [number][period] sequence is not allowed), so the shorter <URL> match is tokenized.
Another improperly broken-up filename-looking thing: "index-h.php" - the <URL> rule matches "index-h.ph", but the <ALPHANUM> rule doesn't match (likely because of the hyphen).
I think the fix here is to disallow <URL>s when there is no trailing port, path, query or fragment, and the following character is [-A-Za-z0-9] (allowable domain label characters).
I'll make a patch.