Users can typically create any filename they like in /tmp, which causes trouble when the nightly cleanup script runs and tries to delete the old ones.
I don't think that's how /tmp works. Aren't those files garbage collected either at boot time or after X days of creation? I mean, if your program creates a file in /tmp and keeps it open for days then you clearly screwed up as you're misusing the whole concept of a temporary file. For that there are better places in the file system hierarchy.