--- Quote Start ---
I'm 99% sure that in the Quartus 5.1 handbook (from May 2005) it says in the design guidelines that one should use the others clause to ensure a safe state for such cases. I can't find it now online for a quote, but I have the relevant page printed out at work. So if no one finds it until then I'll post a snippet on Sunday.
--- Quote End ---
Other than some references specific to Synplify, this is all I found when I searched for "safe" in the QII 5.1 handbook (my copy is dated October 2005). From Volume 1, Chapter 6, in the "State Machines" section:
--- Quote Start ---
If a state machine enters an illegal state due to a problem with the device, the design will likely cease to function correctly until the next reset of the state machine. Synthesis tools do not do anything by default to handle this situation. The same issue applies to any other registers if there is some kind of fault in the system. A default or when others clause does not affect this operation, assuming that your design never deliberately enters this state. Synthesis tools remove any logic generated by a default state if it is not reachable by normal state machine operation.
Some synthesis tools have an option to implement a safe state machine that inserts the default case if it does not exist and preserves the logic in the design to handle illegal states. If a state machine gets into an illegal state for any reason, it returns to the reset state on the next clock edge. Of course this option protects only state machines, and all other registers in the design are not protected this way.
For additional information about tool-specific options for implementing state machines, refer to the tool vendor's documentation or the appropriate chapter in the Synthesis section in volume 1 of the Quartus II Handbook.
--- Quote End ---