Where apache's /tmp located?

It is from a feature of systemd called PrivateTmp.

/var/tmp/systemd-private-*

is /var/tmp for the service with PrivateTmp option set in the .service file.

/tmp/systemd-private-*

is /tmp for the service.

If httpd writes something to /tmp, it will be in /tmp/systemd-private-*-httpd.service-*.

The differences between /tmp and /var/tmp are

The /var/tmp directory is made available for programs that require temporary files or directories that are preserved between system reboots. Therefore, data stored in /var/tmp is more persistent than data in /tmp.

Files and directories located in /var/tmp must not be deleted when the system is booted. Although data stored in /var/tmp is typically deleted in a site-specific manner, it is recommended that deletions occur at a less frequent interval than /tmp.

In Fedora 20, the directory you're looking for is in one of the (possibly multiple) /var/tmp/systemd-private-${FOO} folders. I haven't been able to verify that on a RHEL 7 or CentOS 7 system yet, but I strongly suspect it will be in the same /var/tmp/systemd-private-${FOO} area.

My approach is to find the PID of the running apache process

ps ax | fgrep http

Look for some plausible PID numbers in the left hand column. Then access the /tmp directory via the PID path through /proc which is kind of ugly but saves time figuring out who has found a new and exciting way to mess up the system this version.

ls -l /proc/12345/root/tmp

Those are the files that the httpd process is seeing.