The paper addresses the heat transfer problems associated with a possible leakage of hot (>250°C) lead-bismuth eutectic (LBE) from the MEGAPIE (Megawatt Pilot Target Experiment) spallation source target and whether the double-walled outer safety vessel would be able to contain the accident without serious damage occurring to the facility. Issues addressed are (a) determining the initial impact pressure of the LBE on the inner shell of the safety container, which could result in the gap between the shells being closed, interrupting the flow of D2O coolant; (b) the time taken for the LBE leak to be detected and, hence, activation of the beam trip control; and (c) heat transfer from the hot LBE to the D2O circulating between the safety container walls, which could induce bulk boiling and subsequent pressurization of the circuit. Steps in the model development are described, which include, in particular, numerical tracking of the LBE interface using a level-set method, and the construction of a computer program to calculate the thermal hydraulics of the circulating D2O, including the effects of nucleate boiling on the hot surface, the other side of which is in contact with the leaking LBE. Results of the simulation show that pressures generated by the impact of the jet of LBE on the safety window do not threaten its structural integrity; the time to trigger the leak detection equipment is ~10 ms; and bulk boiling within the D2O circuit is avoided, even if there is a delay of 1 s in actually tripping the beam. Estimates of the margins of safety to bulk boiling are given for the current MEGAPIE and possible future, upgraded liquid-metal targets of similar construction.