Function pointer to printf() problem

My chip has internal ROM and also external ROM. What I want to do is let my customers write their own external program and the internal functions could be called and executed. I did experiment with printf(). I put the function body of it into the internal ROM, with the help of the linker. In the external program, I use a function pointer structure like this:

typedef struct {
	int	(*printf)(const char *, ...);
	char	(*func1)(int);
	int	(*func2)(char);
	int	(*func3)(int,int);
} fpstruct;

Since I am not sure how to declare "printf", I followed the way in stdio.h. The structure is initialized as:

fpstruct tester={
(void*)0x406b,
(void*)0x4600,
(void*)0x4900,
(void*)0x4400};

where the functions' actual addresses are set. Also, my XDATA is defined at 0x3800 which is the RAM area on my chip.
And the internal functions are called like this:

tester.printf("Testing Internal ROM\n");
tester.printf("Calling func2, result=%d\n", tester.func2('A'));
tester.printf("Calling func3, result=%d\n", tester.func3(1,0));

Now the question is, all the above usage of printf() works except the following:

temp=XBYTE[0x5000]; //temp is a local
tester.printf("Calling func1, result=0x%bx\n", temp);

The printf() did not work. Nothing was printed. I checked the list file, found the following interesting thing. The following paragraph is excerpted from the list file of calling the printf() with a local parameter.

; SOURCE LINE # 26
00EC 905000            MOV     DPTR,#05000H
00EF E0                MOVX    A,@DPTR
00F0 FF                MOV     R7,A
00F1 900000      R     MOV     DPTR,#temp
00F4 EF                MOV     A,R7
00F5 F0                MOVX    @DPTR,A
; SOURCE LINE # 27
00F6 7BFF              MOV     R3,#0FFH
00F8 7A00        R     MOV     R2,#HIGH ?SC_74
00FA 7900        R     MOV     R1,#LOW ?SC_74
00FC C003              PUSH    AR3
00FE C002              PUSH    AR2
0100 C001              PUSH    AR1
0102 900000      R     MOV     DPTR,#temp
0105 E0                MOVX    A,@DPTR
0106 FF                MOV     R7,A
0107 900003            MOV     DPTR,#?_Mercury_?BYTE+03H
010A EF                MOV     A,R7
010B F0                MOVX    @DPTR,A
010C 900000      E     MOV     DPTR,#tester
010F E0                MOVX    A,@DPTR
0110 FB                MOV     R3,A
0111 A3                INC     DPTR
0112 E0                MOVX    A,@DPTR
0113 FA                MOV     R2,A
0114 A3                INC     DPTR
0115 E0                MOVX    A,@DPTR
0116 F9                MOV     R1,A
0117 8982              MOV     DPL,R1
0119 8A83              MOV     DPH,R2
011B D001              POP     AR1
011D D002              POP     AR2
011F D003              POP     AR3
0121 120000      R     LCALL   ?C0012
0124 8002              SJMP    ?C0013
0126         ?C0012:
0126 E4                CLR     A
0127 73                JMP     @A+DPTR
0128         ?C0013:

I can't find #?_Mercury_?BYTE anywhere in the project nor in the list or map files. The linker will not give a value and hence it's still 0x0000 after linking. I am not sure yet it's the root cause of the printf() problem.
In my other projects where the actual printf() is compiled and linked the #?_Mercury_?BYTE (or similarly named labels for locals) are given correct values (based from 0x3800 for my chip).
The manuals does not describe much about printf(). Why the declaration of printf() in stdio.h works, while mine does not? Or, in my case, how should I declare printf()?