title: Why does my call to `stringWithFormat:` crash my program?
body: <p>I am trying to use the following format string, but it causes an <code>EXC_BAD_ACCESS</code> trying to read at <code>0xC</code> from <code>objc_msgSend</code>. Clang tells me the format string is valid (aside that it has unused arguments). Here is an SSCCE:</p>
  
  <pre><code>#import &lt;Foundation/Foundation.h&gt;
  
  int main(int argc, const char * argv[])
  {
      @autoreleasepool
      {
          NSString* segment = nil;
          NSString* base = @"ebp";
          char sign = '+';
          long long displacement = 12;
          long long absDisplacement = llabs(displacement);
          NSString* offset = nil;
          NSString* nsSize = @"dword";
  
          NSString* r = [NSString stringWithFormat:@"%7$@ ptr [%2$@ %3$c %5$lli]", segment, base, sign, displacement, absDisplacement, offset, nsSize];
          NSLog(@"%@", r);
      }
      return 0;
  }
  </code></pre>
  
  <p>I don't use all the arguments for the format string because the specific format is to be selected out of 16 possibilities, and some arguments aren't used in all format strings (this specific format string ignores parameters 1, 4 and 6). The types are as follows:</p>
  
  <ol>
  <li><code>NSString*</code></li>
  <li><code>NSString*</code></li>
  <li><code>char</code></li>
  <li><code>long long</code></li>
  <li><code>long long</code></li>
  <li><code>NSString*</code></li>
  <li><code>NSString*</code></li>
  </ol>
  
  <p>And as far as I can tell, all my format specifiers respect that. No printed object argument is nil, even though this is a supported scenario of <code>stringWithFormat:</code>.</p>
  
  <p>So what am I doing wrong?</p>
  
  <p><strong>EDIT</strong> Changing the value of <code>displacement</code> changes the faulty read address, but I can't see why. The format string still looks right to me... I can't figure out the pattern either: 12 crashes at 0xc, 13 crashes at 0x18, 14 crashes at 0xe, 15 crashes at 0x18, 16 crashes at 0x10, 17 causes the program to exit with a status of zero without going through <code>NSLog</code>.</p>