nobody appears to have written a sufficiently specific report of how the PSP 1.50 firmware's "KXploit" worked; everyone just says “sprintf” like that's enough, I can only really guess from there
(this was the one where you had two folders per homebrew program, like IRSHELL and IRSHELL% - the % folder containing an EBOOT.PBP which contained only metadata, and the non-% folder containing an EBOOT.PBP which contained only the ELF executable data)
(my educated guess being that you ask it to load IRSHELL%, it mistakenly uses that string as the first parameter to a sprintf call, result of which (which would be IRSHELL) it then uses to load the other EBOOT.PBP as an executable)
