I was not sure whether this is a problem with the documentation or the code so I am submitting this here as opposed to github.
In setting up Lock version 10 I found that while the documentation indicates that state is a parameter of params which in turn is a parameter of auth (Lock Configuration Options) the code in fact takes state directly from the auth object (lock/index.js at master · auth0/lock · GitHub).
Aside from either the code or the documentation being wrong, a consequence of this is that, as far as I can tell, there is no way to override state when calling lock.show() which, based again on the documentation, is an anticipated developer behavior.