[cozzyd]

Yes if the attacker has control of the string (like if you do printf(getenv("FOO")) or something equally stupid).