Files that are created using the stream wrapper class defined from Drupal, and associated with a path starting with "temporary://" are created in the directory whose name is returned from file_directory_temp() which returns:
The value of the Drupal variable "file_temporary_path," which is set from the setting page on admin/config/media/file-system.
If that Drupal variable is not set, then the function checks one of the following directories; if one of those directories exists, then it is returned (and used).
the directory returned from
ini_get('upload_tmp_dir')on Windows, the directories "c:\windows\temp" and "c:\winnt\temp."
on OSes different from Windows, the directory "/tmp."
on PHP version 5.2.1 or higher, the directory returned by
sys_get_temp_dir().If the variable "file_temporary_path" is not set, and the directories I listed in the previous point don't exist, or are not writable, the function uses the value of the Drupal variable "file_public_path"; by default that directory has the value
conf_path() . '/files'that is the directory "files" contained in the directory containing the setting.php file used for the Drupal site.
The function set the variable "file_temporary_path" to the directory it found.
As far as I know, any module uses file_directory_temp() or opens temporary files using a path starting with "temporary://" (available only in Drupal 7 and higher). The directory returned from file_directory_temp() can change from system to system, but modules always use that directory.
Drupal modules don't have the permission to write the directory containing the modules; it's quite difficult a module uses that directory to create temporary files. If you find a module that uses the directory containing the modules (or any sub-directory of that directory) report that as a bug.