Is it possible to misuse Kernel.to_string, from a security or fault inducing perspective?

That’s right, the relevant docs:

Strings in Elixir also support interpolation. This allows you to place some value in the middle of a string by using the #{} syntax […]

Any Elixir expression is valid inside the interpolation. If a string is given, the string is interpolated as is. If any other value is given, Elixir will attempt to convert it to a string using the String.Chars protocol. This allows, for example, to output an integer from the interpolation