The first main problem exist in security model based on symlinks open_basedir. Paths like $target and $link are checked by open_basedir. We can bypass open_basedir, but function symlink() is not affected.
Issue has been generated by false security model designed by PHP.

Full Advisory : http://securityreason.com/achievement_securityalert/70

Exploit : http://securityreason.com/achievement_exploitalert/14