Your program invokes undefined behavior as it tries to dereference the null pointer.
You need to give sprintf a buffer that is large enough to contain the formatted output string; it will not create one for you. A similar issue arises with strcat; the destination buffer needs to be large enough to contain both strings.