The %.* example is so close to hitting its single most useful application:

  char *something;  /* no null termination */
  size_t something_length;

  printf("%.*s", (int)something_length, something);

Unfortunately, the .* argument has type (int), not size_t, and it's signed… but if that's not a problem this is a great way to format non-\0-terminated strings.

(And of course you can also use it to print a substring without copying it around first.)

Somewhat related to this, printf alone in a loop is Turing-complete, by using %-directives like that. It was introduced in “Control-Flow Bending: On the Effectiveness of Control-Flow Integrity” (Carlini, et al. 2015) and the authors have implemented Brainfuck and an obfuscated tic-tac-toe with it.

[0]: https://nebelwelt.net/publications/files/15SEC.pdf

[1]: https://github.com/HexHive/printbf

[2]: https://github.com/carlini/printf-tac-toe