diff --git a/mozilla/modules/plugin/base/src/nsPluginHostImpl.cpp b/mozilla/modules/plugin/base/src/nsPluginHostImpl.cpp
index 78aa5e62b9f..06aa0eb95d5 100644
--- a/mozilla/modules/plugin/base/src/nsPluginHostImpl.cpp
+++ b/mozilla/modules/plugin/base/src/nsPluginHostImpl.cpp
@@ -270,6 +270,8 @@ static nsActivePluginList *gActivePluginList;
 PRBool gSkipPluginSafeCalls = PR_FALSE;
 #endif
 
+nsIFile *nsPluginHostImpl::sPluginTempDir;
+
 ////////////////////////////////////////////////////////////////////////
 // flat file reg funcs
 static
@@ -1860,14 +1862,10 @@ nsPluginStreamListenerPeer::SetupPluginCacheFile(nsIChannel* channel)
 
   if (!useExistingCacheFile) {
     nsCOMPtr<nsIFile> pluginTmp;
-    // Is this the best place to put this temp file?
-    rv = NS_GetSpecialDirectory(NS_OS_TEMP_DIR, getter_AddRefs(pluginTmp));
-    if (NS_FAILED(rv)) return rv;
-
-    rv = pluginTmp->AppendNative(kPluginTmpDirName);
-    if (NS_FAILED(rv)) return rv;
-
-    (void) pluginTmp->Create(nsIFile::DIRECTORY_TYPE,0777);
+    rv = nsPluginHostImpl::GetPluginTempDir(getter_AddRefs(pluginTmp));
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
 
     // Get the filename from the channel
     nsCOMPtr<nsIURI> uri;
@@ -3246,19 +3244,17 @@ NS_IMETHODIMP nsPluginHostImpl::Destroy(void)
   }
 
   // Lets remove any of the temporary files that we created.
-  nsCOMPtr<nsIFile> pluginTmp;
-  nsresult rv = NS_GetSpecialDirectory(NS_OS_TEMP_DIR, getter_AddRefs(pluginTmp));
-  if (NS_FAILED(rv)) return rv;
+  if (sPluginTempDir) {
+    sPluginTempDir->Remove(PR_TRUE);
 
-  rv = pluginTmp->AppendNative(kPluginTmpDirName);
-  if (NS_FAILED(rv)) return rv;
-
-  pluginTmp->Remove(PR_TRUE);
+    NS_RELEASE(sPluginTempDir);
+  }
 
   if (mPrivateDirServiceProvider)
   {
-    nsCOMPtr<nsIDirectoryService> dirService(do_GetService(kDirectoryServiceContractID, &rv));
-    if (NS_SUCCEEDED(rv))
+    nsCOMPtr<nsIDirectoryService> dirService =
+      do_GetService(kDirectoryServiceContractID);
+    if (dirService)
       dirService->UnregisterProvider(mPrivateDirServiceProvider);
     mPrivateDirServiceProvider = nsnull;
   }
@@ -3279,6 +3275,27 @@ void nsPluginHostImpl::UnloadUnusedLibraries()
   mUnusedLibraries.Clear();
 }
 
+nsresult
+nsPluginHostImpl::GetPluginTempDir(nsIFile **aDir)
+{
+  if (!sPluginTempDir) {
+    nsCOMPtr<nsIFile> tmpDir;
+    nsresult rv = NS_GetSpecialDirectory(NS_OS_TEMP_DIR,
+                                         getter_AddRefs(tmpDir));
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    rv = tmpDir->AppendNative(kPluginTmpDirName);
+
+    // make it unique, and mode == 0700, not world-readable
+    rv = tmpDir->CreateUnique(nsIFile::DIRECTORY_TYPE, 0700);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    tmpDir.swap(sPluginTempDir);
+  }
+
+  return sPluginTempDir->Clone(aDir);
+}
+
 
 ////////////////////////////////////////////////////////////////////////
 /* Called by nsPluginInstanceOwner (nsObjectFrame.cpp - embeded case) */
@@ -6391,22 +6408,14 @@ nsPluginHostImpl::CreateTmpFileToPost(const char *postDataURL, char **pTmpFileNa
     rv = NS_NewLocalFileInputStream(getter_AddRefs(inStream), inFile);
     if (NS_FAILED(rv)) return rv;
 
-    // Create a temporary file to write the http Content-length: %ld\r\n\" header
-    // and "\r\n" == end of headers for post data to
+    // Create a temporary file to write the http Content-length:
+    // %ld\r\n\" header and "\r\n" == end of headers for post data to
+
     nsCOMPtr<nsIFile> tempFile;
-    rv = NS_GetSpecialDirectory(NS_OS_TEMP_DIR, getter_AddRefs(tempFile));
+    rv = GetPluginTempDir(getter_AddRefs(tempFile));
     if (NS_FAILED(rv))
       return rv;
 
-    rv = tempFile->AppendNative(kPluginTmpDirName);
-    if (NS_FAILED(rv))
-      return rv;
-
-    PRBool dirExists;
-    tempFile->Exists(&dirExists);
-    if (!dirExists)
-      (void) tempFile->Create(nsIFile::DIRECTORY_TYPE, 0777);
-
     nsCAutoString inFileName;
     inFile->GetNativeLeafName(inFileName);
     // XXX hack around bug 70083
diff --git a/mozilla/modules/plugin/base/src/nsPluginHostImpl.h b/mozilla/modules/plugin/base/src/nsPluginHostImpl.h
index f0546bba51c..ff6d1dd6491 100644
--- a/mozilla/modules/plugin/base/src/nsPluginHostImpl.h
+++ b/mozilla/modules/plugin/base/src/nsPluginHostImpl.h
@@ -408,6 +408,8 @@ public:
   NS_IMETHOD
   AddUnusedLibrary(PRLibrary * aLibrary);
 
+  static nsresult GetPluginTempDir(nsIFile **aDir);
+
 private:
   NS_IMETHOD
   TrySetUpPluginInstance(const char *aMimeType, nsIURI *aURL, nsIPluginInstanceOwner *aOwner);
@@ -507,8 +509,10 @@ private:
   nsCOMPtr<nsIFile>                    mPluginRegFile;
   nsCOMPtr<nsIPrefBranch>              mPrefService;
   nsRefPtr<nsPluginDirServiceProvider> mPrivateDirServiceProvider;
-  
+
   nsWeakPtr mCurrentDocument; // weak reference, we use it to id document only
+
+  static nsIFile *sPluginTempDir;
 };
 
 #endif