This is due to %s conversion specification, which is defined as "a sequence of non-white-space characters" in ISO/IEC 9899:TC3 draft.

I guess that CreateProcess() family use supplied STARTUPINFO.hStd* values even for GUI executables. It should be checked though.

To be exact, stdxxx handles are stored in the PEB at the ProcessParameters value which is a RTL_USER_PROCESS_PARAMETERS struct (which has StandardInput, StandardOutput, and StandardError HANDLES). You can either access them that way or just through Get/SetStdHandle() with the WinAPI.

Any i/o HANDLE can be used - pipes, files, consoles.