Netscape 4.73 and earlier follows symlinks when it imports a new certificate, which allows local users to overwrite files of the user importing the certificate.
http://www.securityfocus.com/bid/1201
http://archives.neohapsis.com/archives/bugtraq/2000-05/0126.html