It looks like there is some debug code scattered around which is currently disabled. 

#1 in the function 
dump_bitmap in http://cgit.freedesktop.org/spice/spice/tree/server/red_worker.c
appears to write (/create) in /tmp without proper checks first  

    id = ++file_id;
    sprintf(file_str, "%s/%u.bmp", RAM_PATH, id);

    f = fopen(file_str, "wb");
    if (!f) {
        red_error("Error creating bmp\n");
        return;
    }

However, because DUMP_BITMAP  will not be defined - this isn't an issue :)

#2 Likewise because DUMP_JPEG & DEBUG_DUMP_BITMAP isn't defined in 
http://cgit.freedesktop.org/spice/spice/tree/common/canvas_base.c
"However, because  DUMP_JPEG/DEBUG_DUMP_BITMAP will not be defined - this isn't an issue :)"