modules/vfolder/vfolder-info.c, line 350
                                                                          
                                                                          
                                                                            
        tmpfile = g_strdup_printf ("%s.tmp-%d",
                                   info->filename,
                                   (int) (tv.tv_sec ^ tv.tv_usec));
                                                                          
                                                                          
                                                                            
while in libgnomevfs/gnome-vfs-private-utils.c there is a function
gnome_vfs_create_temp that does this securely.
                                                                          
                                                                          
                                                                            
Depending on the location of the file, this may not be that hazardous, but
still it is not on the safe side and it provides another source for
unsecure cut and paste code.
                                                                          
                                                                          
                                                                            
And then there's the scripts in modules/extfs. Here's to hoping these are
never used..