I would prefer that at least some form of sentinel checking be done in
plain -Wall/-Wformat, because most people won't know to use a special
flag to get the new sentinel checking, so the vast majority of users
won't see any benefit from this new warning.
How about if the default -Wall/-Wformat behavior check for sentinels
but in the lenient fashion Michael proposes i.e. allowing __null. And
-Wformat=2 (or some extra flag) is more strict, i.e. disallows __null.
That would ensure -Wall would continue to be useful but not complain
about the NULL macro for people confined to GNU systems, while still
providing a way for those interested in porting to systems where NULL
is 0.
Sound okay?