https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86274
--- Comment #9 from Martin Jambor <jamborm at gcc dot gnu.org> --- As early as the ssa dump we have, in the same function, <bb 3> : __len_13 = _12; __builtin_va_end (&__args); std::allocator<char>::allocator (&D.122645); _1 = (sizetype) __len_13; _2 = __s_7 + _1; std::__cxx11::basic_string<char>::basic_string<char*> (_16(D), __s_7, _2, &D.122645); i.e. construction of basic_string<char> at an undefined address.