Improve safety wrt. special characters in tmpfile snippet

Previously we would expand the variable immediately and surround the expanded variable in single quotes.

This change delays expanding the variable which removes the need to quote it (except for the double-quotes during expansion which indicates that it should be expanded as a single word).
Merge remote-tracking branch 'upstream/master'