Ah, sorry.  Ok.  Now a different issue: the user-defined function can return an interned string.  If it has a refcount of 1, _PyString_FormatLong() will mutate it.  Then when we DECREF it, string_dealloc() will not find it any more in the interned dict and crash with a fatal error.

Note that I'm mostly having fun finding holes in delicate logic, like mutating strings in-place.  It would be much more simple to either (1) stop calling the user-defined functions and behave similarly to most other built-in types; or (2) stop trying to mutate that poor string in-place and always just create a new one. :-)