> if there's a risk I'm overlooking I'd like to better understand it,
> and the relevant Python documentation should be updated.

I don't think there is any special risk that you are overlooking other than a documented fact that Python's strftime is a thin layer on top of system strftime and these are notoriously buggy on many systems.

A python application that accepts custom formats from users should limit those formats to a set that is known to work on the targeted platforms.  Relying on strftime to properly return an error code and not do anything nasty is probably not a good idea.

This said, I express no opinion on the severity of this bug.