How to determine public temp directory on OS X to be write-accessible by www server?
I would write to /tmp (which is equivalent to writing to /private/tmp ) since it's writable by all users and not just administrative users. It's there for compatibility and for bonus points, your script can clean up files or cut them if they grow too large.

I don't have an authoritative reference to why /private was called that, but it's always been open to writing and isn't restricted like $TMPDIR is from non-admin users.

The real question is what user are you running apache - a member of the ADMIN group or just a normal non-admin user?

Apple documents this in the Secure Coding Guide with the admonition that writing files to publicly readable locations is inherently insecure and that it's better to place files in more protected locations that aren't readable by all users. See the Race Conditions and Secure File Operations section and this link on creating secure temporary files. By using the mkstemp POSIX call you ensure a unique file is created and can control access with umask.

Oddly (to me), mktemp when run by a non-admin user can still make a temp file in $TMPDIR so it's clearly using escalated privileges to hand off that more "secure" file to non-admin users. Pretty cool.