In march I've published some research related to Just another PHP LFI exploitation method that used the fact that the PHP engine stores (on disk) uploaded files (rfc1867) for a short period of time, even if scripts don't really expect them. The bottom line was that it's easy to exploit it on Windows, but on *nix it wasn't really possible unless some php script leaks certain information (temporary file name). Well, Brett Moore in his paper "LFI with phpinfo() assistance" pointed out that phpinfo() is the thing you want to look for on *nix.

Link to paper: LFI with phpinfo() assistance by Brett Moore

In short: If you find phpinfo() somewhere, upload a file to it since it dumps the received variables (and that would include temporary file name that's stored in $_FILES). Now, all you need is a piece of code that will exploit a race condition between upload+fetching the name in phpinfo() script and LFI present in another script (and Brett presents an exemplary exploit in his paper, with some additional ideas how to win the race).

From my pentesting experience: phpinfo() tends to be lying around on PHP-based websites, commonly in files like test.php, info.php, php.php or phpinfo.php, etc. So, if you can find a phpinfo() script, this method is usable and the upload method becomes exploitable on *nix (if you can win the race that is).

Good work Brett :)