I was browsing the nautilus source code and found these:

libnautilus-private/nautilus-file-utilities.c, line 343
                                                                          
                                                                          
                                                                            
nautilus_unique_temporary_file_name (void) {
        const char *prefix = "/tmp/nautilus-temp-file";
        char *file_name;
        static guint count = 1;
                                                                          
                                                                          
                                                                            
        file_name = g_strdup_printf ("%sXXXXXX", prefix);
                                                                          
                                                                          
                                                                            
        if (mktemp (file_name) != file_name) {
                g_free (file_name);
                file_name = g_strdup_printf ("%s-%d-%d",
prefix, count++, getpid ());
        }
                                                                          
                                                                          
                                                                            
        return file_name;
                                                                          
                                                                          
                                                                            
}
                                                                          
                                                                          
                                                                            
This one in libnautilus-private/nautilus-metafile.c, line 1740 is secure.
                                                                          
                                                                          
                                                                            
                temp_path = g_strconcat (metafile_path, "XXXXXX", NULL);
                failed = FALSE;
                                                                          
                                                                          
                                                                            
                fd = mkstemp (temp_path);
                if (fd == -1) {
                        failed = TRUE;
                }
                                                                          
                                                                          
                                                                            
This one in src/nautilus-profiler.c, line 287 'snatched defeat from the
jaws of victory':
                                                                          
                                                                          
                                                                            
        dump_file_name = g_strdup ("/tmp/nautilus-profile-log-XXXXXX");
                                                                          
                                                                          
                                                                            
        fd = mkstemp (dump_file_name);
                                                                          
                                                                          
                                                                            
        if (fd != -1) {
                close (fd);
        } else {
                g_free (dump_file_name);
                dump_file_name = g_strdup_printf
("/tmp/nautilus-profile-log.%d", getpid ());
        }