Around line 109 we're doing expansion of the %M% keyword:

            case 'M':
              {
                const char *mod = get_module_name().c_str();
                err = fputs_failed(fputs(mod, out));
              }
            break;

Problem is that by the time the fputs is done the temporary holding the return from get_module_name has been freed, so using mod is a use after free.  This can show up as garbage being substituted in for %M%, especially when the module name is long.

A quick fix is:

             case 'M':
               {
-                const char *mod = get_module_name().c_str();
-                err = fputs_failed(fputs(mod, out));
+                string mod = get_module_name();
+                err = fputs_failed(fputs(mod.c_str(), out));
               }

(Debian bug 998642)