If you look at how the query works, this is not a case of ...
- Check to see if the passed query conditions return posts
- Else run a fallback query
What happens is that your conditions are merged with certain defaults via a very complicated sequence of conditionals. At the end of that, you have the
SQL that runs to get your posts. The system doesn't check to see if your conditions are "crap" and then decide to use them or not. Those conditions just get merged into the query in a way that generates a valid
SQL statement. I am not sure how the query would know what is and isn't "crap" anyway.
The only thing I can think of doing would be to hook to
pre_get_posts and check the query vars according to some set of conditions that you define to determine "crap" or "not crap".
As for the particular example you provide,
get_posts is intentionally written to retrieve the latest post if not passed any arguments.
new WP_Query('') will not return anything, by the way, but essentially I agree with @toscho's suggestion in a comment-- pass a sanitized string. Know what you are sending to the function before you send it. If the string is empty or doesn't meet some other requirement, don't call the
get_posts function at all.