What does the FPGA do with unreferenced I/O pins?

By default, Quartus II used to set unused pins as outputs driving low. This wasn't good as you can imagine - one wrong pin constraint and a used input pin could be wrongly considered unused and be driving a shorting low onto the input signal.

In more recent versions, it was changed to the sensible 'as input tri-stated with weak pull-up', which saved me having to go and change it to this every time I created a new project.

You can change it in Assignments/Device/DeviceAndPinOptions/UnusedPins, which bring up the below dialogue box: