While others have noted that the asterisk circumvents appropriate use of globbing, there are really three fixes.
1. Defensively check the setting of the variable and presence of the directory to print reasonable error messages.
2. Use 'set -u' or 'set -o nounset' to avoid any unset variables.
3. Do not include the unnecessary astersisk to avoid globbing and fall back on modern operating system safe defaults when a bare / is specified.
I only include #1 because when using set -e and set -u as recommended by Pashley (among others), you should probably handle the things explicitly and gracefully for something to be run by an end user.