/tmp is most definitely not hardcoded, if you set $TMPDIR, you have full control