homepage

> if there's a risk I'm overlooking I'd like to better understand it,
> and the relevant Python documentation should be updated.
I don't think there is any special risk that you are overlooking other than a documented fact that Python's strftime is a thin layer on top of system strftime and these are notoriously buggy on many systems.
A python application that accepts custom formats from users should limit those formats to a set that is known to work on the targeted platforms. Relying on strftime to properly return an error code and not do anything nasty is probably not a good idea.
This said, I express no opinion on the severity of this bug.