use unique_ptr to ensure release
Fixed instances of hexchat_printf that unsafely used a string parameter as a format string.

Fixes #1153
merge from hexchat master