// Clause: 7.21.6.1 — %s expects a pointer to a null-terminated array of char; passing a dangling pointer leads to UB.
#include <stdio.h>
const char* bad(void){
    char s[] = "hi";
    return s; // returns pointer to dead object
}
int main(void){
    const char *p = bad();
    printf("%s\n", p); // UB: dangling pointer
    return 0;
}