$tmp_path = (!@ini_get('safe_mode')) ? false : $phpbb_root_path . 'cache';

$filename = tempnam($tmp_path, unique_id() . '-');

Looks like there is a mistake in !@ini_get('safe_mode'). If we have safe_mode "Off" in php.ini, $tmp_path become "" and function.tempnam() trying to record temporary avatar-file in a default system temp path, which may be out of range because of the open_basedir restriction and cause such error:
[phpBB Debug] PHP Notice: in file /includes/functions_upload.php on line 745: tempnam() [function.tempnam]: open_basedir restriction in effect. File(/var/tmp) is not within the allowed path(s): (/home/web)

I suggest it must looks like this: @ini_get('safe_mode'), without "!".
Am I wrong and this is a feature?