Bug T38358[1] points out that using a '#' character in input passed to ApiQueryBase::titlePartToKey() will silently truncate at the character before the '#', often generating incorrect results.
With the merge of Gerrit change 191889,[2] passing a '#' into this method will now return an invalidtitle error, just as already happens when a title-part containing invalid characters such as '<' or '>' is passed in.
The affected parameters include:
* list=allpages apto, apfrom, and apprefix
* list=alldeletedrevisions adrto, adrfrom, and adrprefix
* list=deletedrevs drto, drfrom, and drprefix
* list=filearchive fato, fafrom, and faprefix
* list=allimages aito, aifrom, and aiprefix
* list=alllinks alto, alfrom, and alprefix
* list=alltransclusions atto, atfrom, and atprefix
* list=allfileusages afto, affrom, and afprefix
* list=allredirects arto, arfrom, and arprefix
* list=allcategories acto, acfrom, and acprefix
This should be deployed to WMF wikis with 1.25wmf19, see https://www.mediawiki.org/wiki/MediaWiki_1.25/Roadmap for the schedule.