overflows the string if it encounters a truncated sequence, e.g. a trailing % or %u with less than 4 hex chars.
The old code relied on the null character after the last character in the string, but that changed when it started to accept widestrings.