Locate safe token in expression