diff --git a/c/xmlwr.c b/c/xmlwr.c
index f81d94c..2d31fec 100644
--- a/c/xmlwr.c
+++ b/c/xmlwr.c
@@ -27,6 +27,8 @@ static void fuxmlwr_destroy(pTHX_ fuxmlwr *wr) {
 
 
 static void fuxmlwr_escape(pTHX_ fuxmlwr *wr, SV *sv) {
+    if (SvROK(sv) && !SvAMAGIC(sv)) fu_confess("Invalid attempt to output bare reference");
+
     STRLEN len;
     const unsigned char *str = (unsigned char *)SvPV_const(sv, len);
     const unsigned char *tmp, *end = str + len;
@@ -96,7 +98,7 @@ static void fuxmlwr_tag(pTHX_ fuxmlwr *wr, I32 ax, I32 offset, I32 argc, int sel
         val = ST(offset);
         offset++;
 
-        // Don't even try to stringify other arguments; non-string keys are always a bug.
+        // Don't even try to stringify attribute names; non-string keys are always a bug.
         if (!SvPOK(key)) fu_confess("Non-string attribute");
         keys = SvPVX(key);
 
diff --git a/t/xmlwr.t b/t/xmlwr.t
index e8b2d95..becb96c 100644
--- a/t/xmlwr.t
+++ b/t/xmlwr.t
@@ -65,4 +65,21 @@ sub t {
 
 is fragment { t 'arg' }, '<div attr1="arg"><span>ab&quot; &lt; c &amp;&lt; d</span><span><ok🥳ay></span>🥳</div>';
 
+ok !eval { fragment { tag_ 'hi', \1 } };
+like $@, qr/Invalid attempt to output bare reference/;
+
+ok !eval { fragment { tag_ 'hi', {} } };
+like $@, qr/Invalid attempt to output bare reference/;
+
+is fragment { tag_ 'hi', bless {}, 'XTEST1' }, '<hi>string</hi>';
+like fragment { tag_ 'hi', bless {}, 'XTEST2' }, qr{<hi>HASH\(.*\)</hi>}; # Yeah, whatever.
+like fragment { tag_ 'hi', ''.{} }, qr{<hi>HASH\(.*\)</hi>};
+
 done_testing;
+
+
+package XTEST1;
+use overload '""' => sub { 'string' };
+
+package XTEST2;
+use overload '""' => sub { {} };