SFTP chroot: Writable root

[David Newall]

On 05/01/18 20:06, Jakub Jelen wrote:
> if the confined user has write access to the chroot directory,
> there are ways how to get out, gain privileges and or do other
> nasty things.

I'm not inexperienced with UNIX and unix-like operating systems (30+ 
years), and I can't think what these ways are.  Although clearly 
off-topic, I wonder if you could expound on this?