After more digging, it appears that the permissions on /var/lib/roundcube/temp on my server did not allow writing for the PHP user. So the file was created in /tmp instead. You can close the bug, or add an exception for this kind of situations (that would be nice). Thanks.