readdir_r considered harmful

As promised, an advisory on security flaws resulting from the specification and (mis)use of readdir_r. Yawn. I should have finished writing this at the weekend instead of staying up now.