Yes, you're correct, I was thinking that % is escaped with a backslash, not another %. Memory lapse.

In that case the pattern might look like this:

I'm still a little curious what problem we're really solving. Why parse and encrypt a sprintf format specifier in the first place? A format string should be considered code, not data accepted from the outside world. What's the underlying need here?

perl -E 'my $f = shift @ARGV; say sprintf $f, "foo"' '%9999999999s'
[download]

(consumes 1.3GB RAM)