[tedunangst]

A link is just a directory entry. If you can write to the directory, you can create entries in it. And back in olden times, mkdir was setuid because it wasn't a syscall.