This boils down to line 116 in advanced-custom-fields/core/fields/relationship.php:
$where .= " AND " . $wpdb->posts . ".post_title LIKE '%" . esc_sql( like_escape( $title ) ) . "%'";
Using WordPress 4.0 syntax, this is now:
$where .= " AND " . $wpdb->posts . ".post_title LIKE '%" . esc_sql( $wpdb->esc_like( $title ) ) . "%'";
(this works even when WP_DEBUG is true)