Thinking about it some more, the startsWith check would give a false positive when checking nested components.  However, if we check for the JSF client ID sperator in the trailing piece, we would be more rigorous.

I implemented the above check, and pushed the change to the github branch:

https://github.com/richfaces/components/tree/feature/RF-10862

The check is done in the method:

    public static boolean isBehaviorSourceValid(char separatorChar, String behaviorSource, String clientId) {
        if (behaviorSource == null) {
            return false;
        }
        if (!behaviorSource.startsWith(clientId)) {
            return false;
        }
        int suffixStart = behaviorSource.indexOf(clientId);
        int suffixEnd = suffixStart + clientId.length();
        String suffix = behaviorSource.substring(suffixEnd);
        boolean containsSeperatorChar = (suffix.indexOf(separatorChar) >= 0);
        return (! containsSeperatorChar);
    }

I remedied RF-10862 by firing an additional event with the ID of the autocomplete component, rather than loosening up the RenderkitUtils decodeBehaviours restrictions.

If more similar issues come up, we can take another look at loosening up the decodeBehaviours restrictions.

This came up again with RF-12114.  I again resolved the issue by firing secondary events.  We need a more robust solution, as this undobtedly affects other components too.

The DOM event model supports bubbling of events, we should consider supporting a similar bubbling of events within event model of the JSF component tree.  The startWith/separationChar check suggested above seems like a good start at supporting such a bubbling of events, by restricting the "bubbling" of JSF events accross JSF component boundaries.

We should build the required tests to guard against regressions, and make the above change.