At some point, Firefox switched from a host name list where you could use a wild card to a principal list (protocol + hostname) that ignores wildcards. I don't know whether it is possible to change how principals are interpreted to allow wildcard characters again. ??
Regarding how it works now, I think success/failure with the base domain depends on how the site specifies the domain when it sets the cookie. If the sites always specifies the base domain across all the subdomains, then you only need the one exception for the base domain. However, many sites are not that consistent and may use a mix of domains for their cookies.
You actually can see which domains they specify by opening the Storage Inspector (Shift+F9) when you're on the page. I can't remember which columns appear automatically, but you can select the columns by right-clicking any existing column heading and clicking in the pop-up list. On this page, for example, I see many cookies on .mozilla.org and many cookies on connect.mozilla.org. So probably two exceptions are needed in this case.
