[Bug 528000] New: Tainted variables in sprintf format