I'm away from my Mac at the moment, but FWIW, the crash does not appear to
happen on Windows (MSYS64):

*(0)> printf -v result " %5'd"*
*printf: %5': invalid directive*
*(1)> $0 --version*
*zsh 5.9 (x86_64-pc-msys)*


On Sat, Jun 8, 2024 at 5:13 PM Philippe Altherr <philippe.altherr@gmail.com>
wrote:

> On macOS 14.5 running Zsh 5.9, the following command crashes Zsh:
>
> % zsh -c "printf -v result \" %5'd\""
>
> zsh:printf:1: %5': invalid directive
>
> zsh(41890,0x7ff8450ddfc0) malloc: *** error for object 0x600002c811e0:
> pointer being realloc'd was not allocated
>
> zsh(41890,0x7ff8450ddfc0) malloc: *** set a breakpoint in
> malloc_error_break to debug
>
> zsh: abort      zsh -c "printf -v result \" %5'd\""
>
> Surprisingly, dropping the -v option, removing the space before the %, or
> adding an echo command after the printf command avoid the crash:
>
> % zsh -c "printf \" %5'd\""
>
> zsh:printf:1: %5': invalid directive
>
>  *%*
>
> % zsh -c "printf -v result \"%5'd\""
>
> zsh:printf:1: %5': invalid directive
>
> % zsh -c "printf -v result \" %5'd\"; echo foo"
>
> zsh:printf:1: %5': invalid directive
>
> foo
>
> Philippe
>
>

-- 
Mark J. Reed <markjreed@gmail.com>