There really should be a warning on https://secure.byond.com/docs/ref/#/proc/locate in the same style as https://secure.byond.com/docs/ref/#/client/proc/Topic

Something along the lines of:
When using locate() with a TextRef issued from untrusted input (such as Topic), always validate the returned object to make sure it is of the type you expect. If players control the ref, they can craft it to refer to any object of any type. Check that the returned object is of the proper type with istype()