This paper goes into great detail describing how to utilize format string attacks with limited buffer space.