Questionnaire: use the format-string bug for a leak or write, then redirect execution to the flag path.