There is a bug in printing out failures for string asserts/expectations, if the expected or actual string has '%', because it is later on used in call to vprintf(), which will interpret it as a format specifier.
I found it while testing some URL encoding - expected string was "i%22zec" (URL encoded "i\"zec"), but the output was something like: "i 2352356163ec". The "nice" thing is that you won't see it if test passes, as the problem is not in the comparison, but just in the reporting of failed comparison.
The attached patch is maybe not the smartest thing to do, but it works - I added doubling of '%' to "%%" in the string to be returned from failure_message_for() in message_formatting.c.
Thanks for that report. A fix based on your patch is included in revision 561.