In shared enviroment "untrusted" user can paralyze mysql server using specialy crafted query that will create huge on disk tmp table in tmpdir. This is especialy true when tmpdir is on ssd...

• there is limit on how much tmp table can be in memory but not on disk. On disk it can grow forever. There should be limit for tmp tables on disk (per query, and idealy per mysql user)
• it is almost impossible to corelate files in tmpdir with actual queries or mysql users - filenames has no mysql queiry id or usernames - it should be named with it.
• tmpdir usage is not logged (optinaly or not). There should be logging with mysql username, query id when created tmp table is above ...MB so situation can be retroactively investigated.
• There is no way to use multiple drives for tmpdir with priority (use /ssd/tmpdir up to 5GB and use /harddrive/tmpdir for above)
• there should be separate location for on disk tmp tables for queries and tmp tables for innodb inner workings (hash tables). Overfilling space for tmp tables on disk should not halt innodb server wide.

I've posted same on oracle bug tracker. http://bugs.mysql.com/bug.php?id=70857