I get the same exact error using Visual Studio 2005 and CompuWare Bounds Checker. At least on this platform, I think the secret is in the runtime library. In particular in the function __getgmtimebuf( ).

A call to localtime() definitely results in allocated memory, it's allocated in __getgmtimebuf( ) as shown below (look for _malloc_crt()). What happens is the library will allocate memory on the first call, then keep a pointer to...