I've found these two variables ($field and $handler) in the _entityreference_autocomplete_validate(), which are overridden right after declaration.

Support from Acquia helps fund testing for Drupal Acquia logo