Executable files are writable. It's possible to attach user's library to suid executable. Symbolic links problem.
vulners.com/securityvulns/securityvulns:doc:9572
vulners.com/securityvulns/securityvulns:doc:9619
vulners.com/securityvulns/securityvulns:doc:9620
vulners.com/securityvulns/securityvulns:doc:9621