Build an NFA from a regular expression one piece at a time, by Thompson's or Sipser's construction, then run a word on it.
This interactive visualization needs JavaScript.