printf-family called with a variable format string enables format string attacks.
Always pass a constant format string such as printf("%s", var).