[Bug 528000] Tainted variables in sprintf format