MCX Client for Apple Mac OS X 10.4.x up to 10.4.1 insecurely logs Portable Home Directory credentials, which allows local users to obtain the credentials.
http://securitytracker.com/id?1014148
http://lists.apple.com/archives/security-announce/2005/Jun/msg00000.html