3. Create a new attribute which has to be used when a function returns a ref to a parameter and use that to make it illegal to pass a ref to a localvariable to such functions.
If this is the way to go, maybe "@saferef" could double as both @safe and @inoutref.
[OT] I've not been here for a while, but I've been reading up on the D boards again. I might want to help with the standard library lexer and parser. Happy New Year...