Same bug in switch_ivr_async.c, method switch_ivr_record_session.
switch_ivr_play_say.c, line 486.file = switch_core_session_sprintf(session, "%s%s%s%s", switch_str_nil(tfile), tfile ? "]" : "", prefix, SWITCH_PATH_SEPARATOR, file);There should be five %s, not four.