use make_tmpname to avoid finalizer races