Yes, even with an unlink right before. You only narrow the window of opportunity. Another very common problem is the mktemp function. Heed the warnings of the bsd linker about its uses. These must be fixed .
Correct code using mkstemp includes the source to ed or mail .
A rare instance of code that uses mktemp correctly can be found in the rsync port. Just because you can read it doesn't mean you should. A well-known hole of this nature was the startx problem. As a setuid program, you could launch startx with any file as a script. If the file was not a valid shell script, a syntax error message would follow, along with the first line of the offending file, without any further permission check.