Sure.
The result will differ between debug and release (clean).
A local variable is EBP-(some offset) if you look at the assembly.
This means, HIGHER IN STACK, as in "further".
This is the address you return.
Normally it would be untouched if the function just returns. In debug build on some compilers, it would be garbaged on purpose to help you catch the dangling pointer error faster. Now, printf call reuses the same addresses in the stack to pass parameters and for its own local variables (it has some). They will be written to the address emptied by func1 return, thus overwriting whatever is pointed by the address you obtained.
