<-->
int main( int argc, char **argv ) {
    int  test = 0x23232323;
    char buffer[ 256 ];

    printf( "test auf: %p\n", &test );   
    printf( "test enthaelt: %x\n\n", test);

    snprintf( buffer, sizeof buffer, argv[1] );

    printf( "%s\n", buffer);
    printf( "test enthaelt: %x\n\n", test);

    return 0;
}

# ./vuln "AAAA%p %p %p %p %p %p%n  %p %p"
test auf: 0xbfbff6c0
test enthaelt: 0x23232323

Segmentation fault (core dumped)