The format string and arguments aren't consistent, so the stack is not unwound properly. As the result, the caller's addressing (like %esp + auto variable offset) becomes irrelevant to the actual addresses and gives wrong values.