In PHP 5.1.4 it is possible to create a file with any name by exploiting a vulnerability in tempnam().
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/47367/php5-tempnam.txt
Source: https://packetstormsecurity.com/files/47367/php5-tempnam.txt.html