In the last 10 years, many things changes, and people are today much more worried about security. If a program does not honor the environment variable TMPDIR it is regard as a bug and it is a problem for distributions, etc. NaviServer honors TMPDIR since 3 years.
Anyhow, you are right, this should be fixed [1]. Many thanks for the report.
-g
[1] http://cvs.openacs.org/changelog/OpenACS?cs=oacs-5-9%3Agustafn%3A20160225120331
