This is regarding the HC-SR501 sensor.
1. They work just fine.
2. Supply with +5V, and the signal output is +3.3V, so safe for the ESP-8266. I’ve measured mine as +3.33v output when supplied +5.04v from USB.
I can cite no written source for #2. “I read it somewhere on teh interwebz” so I tested it, and it appears safe.
I’ve also read that Espressif might have let the cat out of the bag on a forum post that the GPIO’s are +5V tolerant.