fix _tmpfile to allocate mode argument correctly

Pretty sure this is a bug. Without it I get a crash with some assertion failures.