SECURITY: sandbox handling of format/2.