ZEND_API int zend_delete_global_variable(zend_string *name) /* {{{ */
{
    return zend_hash_del_ind(&EG(symbol_table), name);
}
/* }}} */

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.