There is an environment variable TMPDIR=/tmp so maybe some programs are using it (or TMP or TEMP var) you could try filling them with different values and watch where programs create their files