diff --git a/format.c b/format.c
index 4b15e0fa..001cb979 100644
--- a/format.c
+++ b/format.c
@@ -40,7 +40,7 @@ struct format_entry;
 typedef void (*format_cb)(struct format_tree *, struct format_entry *);
 
 void	 format_job_callback(struct job *);
-const char *format_job_get(struct format_tree *, const char *);
+char	*format_job_get(struct format_tree *, const char *);
 void	 format_job_timer(int, short, void *);
 
 void	 format_cb_host(struct format_tree *, struct format_entry *);
@@ -214,7 +214,7 @@ format_job_callback(struct job *job)
 }
 
 /* Find a job. */
-const char *
+char *
 format_job_get(struct format_tree *ft, const char *cmd)
 {
 	struct format_job	fj0, *fj;
@@ -244,7 +244,7 @@ format_job_get(struct format_tree *ft, const char *cmd)
 	if (ft->flags & FORMAT_STATUS)
 		fj->status = 1;
 
-	return (fj->out);
+	return (format_expand(ft, fj->out));
 }
 
 /* Remove old jobs. */
@@ -726,9 +726,9 @@ format_expand_time(struct format_tree *ft, const char *fmt, time_t t)
 char *
 format_expand(struct format_tree *ft, const char *fmt)
 {
-	char		*buf, *tmp, *cmd;
+	char		*buf, *tmp, *cmd, *out;
 	const char	*ptr, *s, *saved = fmt;
-	size_t		 off, len, n, slen;
+	size_t		 off, len, n, outlen;
 	int     	 ch, brackets;
 
 	if (fmt == NULL)
@@ -768,18 +768,20 @@ format_expand(struct format_tree *ft, const char *fmt)
 			tmp[n] = '\0';
 			cmd = format_expand(ft, tmp);
 
-			s = format_job_get(ft, cmd);
-			slen = strlen(s);
+			out = format_job_get(ft, cmd);
+			outlen = strlen(out);
 
 			free(cmd);
 			free(tmp);
 
-			while (len - off < slen + 1) {
+			while (len - off < outlen + 1) {
 				buf = xreallocarray(buf, 2, len);
 				len *= 2;
 			}
-			memcpy(buf + off, s, slen);
-			off += slen;
+			memcpy(buf + off, out, outlen);
+			off += outlen;
+
+			free(out);
 
 			fmt += n + 1;
 			continue;
diff --git a/tmux.c b/tmux.c
index 6e1de6f6..b8373ab7 100644
--- a/tmux.c
+++ b/tmux.c
@@ -131,8 +131,6 @@ makesocketpath(const char *label)
 	uid = getuid();
 	if ((s = getenv("TMUX_TMPDIR")) != NULL && *s != '\0')
 		xsnprintf(base, sizeof base, "%s/tmux-%u", s, uid);
-	else if ((s = getenv("TMPDIR")) != NULL && *s != '\0')
-		xsnprintf(base, sizeof base, "%s/tmux-%u", s, uid);
 	else
 		xsnprintf(base, sizeof base, "%s/tmux-%u", _PATH_TMP, uid);