Format string vulnerabilities

It's better than expecting that the program's name will always match the compiled-in name.

Sure, you get a new input vector, but that text is in your program anyway, and will be evaluated by some code you didn't write. I'm not convinced this is a real problem. Patterns where you allow program generated text to be used as a format string really should be either not used or very very carefully audited.