$filename = tempnam("/tmp", "blah");

<do all kinds of stuff that takes more than 0 seconds>

$fd = fopen($filename, "w+");

This could result in another proces on the system creating a temp-file with the same name in the meantime, which then will be overwritten by PHP.

See man mkstemp on any UNIX for more details and the solution to the same problem (returning a file descriptor of a newly opened temp-file instead of a filename).

It could be that PHP found a way to magically circumvent the problem, but that is not documented anywhere I looked.