There's a Linux kernel patch floating on the net, and now has been
published in Phrack, that is supposed to make /tmp directories more
secure. In particular, it claims to keep users from creating hard
links in +t directories.
However the patch does not protect the rename call, so the following
should give you a hardlink to passwd in /tmp:
mkdir /tmp/foo (no sticky bit on foo)
ln /etc/passwd /tmp/foo
mv /tmp/{foo/,}passwd
Cheers
Olaf