This function does not account for virtualhost-specific modifications to the temp path and/or open_basedir:
<Virtualhost>
php_admin_value open_basedir /home/user
php_admin_value upload_tmp_dir /home/user/tmp
php_admin_value session.save_path /home/user/tmp
</Virtualhost>
Within this config it still returns /tmp