While surfing over to check out my friends @ www.netric.org I found a nice tutorial by The Itch on format string exploitation.

functions vulnerable to wrong formatting are:

fprintf();
printf();
sprintf();
snprintf();
vfprintf();
vprintf();
vsprintf();
vsnprintf();
setproctitle();
syslog();
and many others like err*, verr*, warn* and vwarn*.
Read it all here