Unsafe /tmp/plugtmp directory exploitable to erase user's files — Mozilla

A predictable name is used for the plugin temporary directory. A malicious local user could symlink this to the victim's home directory and wait for the victim to run Firefox. When Firefox shuts down the victim's directory would be erased...