This is very dangerous when the exception is a VM exception.

We had an issue recently with an application that is designed to shut down gracefully if an OOM occurs. However, the OOM occurred during an expensive toString call, the exception was swallowed, and the application proceeded to blow up badly.

I don't think the message formatter should swallow exceptions at all. I do expect changing log levels to change the behaviour of my program - in particular, by printing more things and incurring whatever the consequences of that are.

However, that is probably too large a change to make now. Not catching VM errors, on the other hand, seems likely to be desirable behaviour in all cases.