http://en.wikipedia.org/wiki/Hydrogen_safety
Just adding some more details here.
In general hydrogen is a much safer gas than typical automotive fuel such as gas or diesel. This is because hydrogen alone cannot combust and requires an oxygen source. Hydrogen storage is a bit safer too since it is lighter than air and floats up. You simply need to allow it to escape at the top and simple fanning lowers the hydrogen to oxygen mixture below the point of combustion easily. As opposed to gas which in vapor form still sits on the ground and requires much less oxygen to combust.
And as you said if a tank is punctured and then ignited, it will burn outside the tank; it will not explode the tank, since the pure hydrogen inside cannot combust. The flame outside however does burn at a very, very high temperature and is invisible since it gives off photons in the ultraviolet wavelength.
The problem with fuel cells however is the energy chain. Electrolysis is not a good way to create hydrogen because most countries, or at least the US cannot keep up with electricity demands (at least currently) should cars and other products be switched over. The primary way hydrogen is manufactured now, if my data is still current is through natural gas. And therefore this doesn't get us away from traditional carbon issues. The potential of hydrogen is possibly good intermediate storage, or at least another vector of energy research we can pursue.
As for those people who say 'Hindenburg,' the problem with that, should they actually read the link they should know that the hydrogen cannot burn by itself and requires another source of oxygen. http://en.wikipedia.org/wiki/Hindenburg_disaster#Fire.27s_initial_fuel One of the theories implicates the iron oxide in the paint, and another speculates on a leakage of oxygen into the blimp. Although, as we saw the Hindenburg burned bright red, we know it was not the hydrogen burning by itself since it doesn't burn in the visible color spectrum.