Recently I wanted to mask "x11-drivers/ati-drivers-*_beta*" to prevent all beta versions of ati-drivers from being merged. No current method of masking appears to work EXCEPT to mask all versions then unmask each specific non-beta version. It would seem possible to extend portage to handle a mask like I wanted.
This is fixed in git: http://git.overlays.gentoo.org/gitweb/?p=proj/portage.git;a=commit;h=68288994493ee3ab56d0baf24ec3d0449330ccf5
This is fixed in 2.1.11.26 and 2.2.0_alpha137.