Curious: I couldn't get an example C program calling printf("%s\n", "two", "strings"); to crash or display any errors under Valgrind or -fsanitize=address -fsanitize=undefined even with full optimization and with omitted frame pointers, despite it being undefined behaviour.

Not passing enough arguments in C for %s, though, causes a crash pretty quickly, because printf tries to interpret as a pointer something that was left on the stack from a previous function call, whatever it was. I got a lucky (null) a few times (stack had been filled with zeroes, and some C libraries handle NULL for %s as a special case, which is not required by the standard), then crashed on a different run when it tried to dereference address 0x1.