>Well, if it is really not specified anywhere, I think this rests on shaky foundations if "trusted" means "trust that the implementor did what I think he did".

I don't think this is debatable. There's no memory invalidation.

>What about thread-safety? As an analogy, are @safe functions allowed to access __gshared globals, should they?

This is a strong point. In reality the pointer returned should point to a shared object because the function is not guaranteed to be reentrant.