Where are temporary files created?
Files are created in the directory whose name is returned from file_directory_temp() which returns:


The value of the Drupal variable "file_temporary_path," which is set from the setting page on admin/config/media/file-system (Drupal 7) or admin/settings/file-system (Drupal 6).
If that Drupal variable is not set, then the function checks one of the following directories; if one of those directories exists, then it is returned (and used).


the directory returned from ini_get('upload_tmp_dir')
on Windows, the directories "c:\windows\temp" and "c:\winnt\temp."
on OSes different from Windows, the directory "/tmp."
on PHP version 5.2.1 or higher, the directory returned by sys_get_temp_dir().

If the variable "file_temporary_path" is not set, and the directories I listed in the previous point don't exist, or are not writable, the function uses the value of the Drupal variable "file_public_path"; by default that directory has the value conf_path() . '/files' that is the directory "files" contained in the directory containing the setting.php file used for the Drupal site.


The function set the variable "file_temporary_path" to the directory it found.

As far as I know, any module opens temporary files using a path starting with "temporary://" (available only in Drupal 7 and higher) or uses file_directory_temp(). The directory returned from file_directory_temp() can change from system to system, but modules always use that directory.

Drupal modules don't have the permission to write the directory containing the modules; it's quite difficult a module uses that directory to create temporary files. If you find a module that uses the directory containing the modules (or any sub-directory of that directory) report that as a bug.