Where is $form_state stored between form build, and form submit functions?
The cache_form table stores $form_state, so except for the values passed on by the client, which should be validated anyway, it is safe to trust the content in $form_state.