Fixed crash in tmpfile()