Fix tmp dir for HgDriver

src/Composer/Repository/Vcs/HgDriver.php

@@ -34,11 +34,10 @@ class HgDriver extends VcsDriver
         $this->tmpDir = $this->config->get('home') . '/cache.hg/' . preg_replace('{[^a-z0-9]}i', '-', $url) . '/';
 
         $url = escapeshellarg($this->url);
-        $tmpDir = escapeshellarg($this->tmpDir);
         if (is_dir($this->tmpDir)) {
-            $this->process->execute(sprintf('cd %s && hg pull -u', $tmpDir), $output);
+            $this->process->execute(sprintf('cd %s && hg pull -u', escapeshellarg($this->tmpDir)), $output);
         } else {
-            $this->process->execute(sprintf('cd %s && hg clone %s %s', escapeshellarg(dirname($this->tmpDir)), $url, $tmpDir), $output);
+            $this->process->execute(sprintf('cd %s && hg clone %s %s', escapeshellarg(dirname($this->tmpDir)), $url, escapeshellarg($this->tmpDir)), $output);
         }
 
         $this->getTags();