When string formatting is supported, it's sometimes possible pass in a string which could contain a percentage symbol which would then be interpreted.
For example, this
frame-title-format has a bug when the file name contains
(setq-default frame-title-format '((:eval (if (buffer-file-name) (abbreviate-file-name (buffer-file-name)) "%b")) (:eval (if (buffer-modified-p) " *")) " emacs"))
How can a string have formatting characters converted into literals?