Steps to reproduce:

1. Create a forward mount point with plaintextnames enabled
2. Mount as root user with allow_other
3. For testing purposes create a file /tmp/file_owned_by_root which is owned by the root user
4. As a regular user run inside of the GoCryptFS mount:

mkdir tempdir
mknod tempdir/file_owned_by_root p &
mv tempdir tempdir2
ln -s /tmp tempdir

When the steps are done fast enough and in the right order (run in a loop!), the device file will be created in tempdir, but the lchown will be executed by following the symlink. As a result, the ownership of the file located at /tmp/file_owned_by_root will be changed.