If you run dbx (tested on 3.11.10) on a setuid root program that you have read access to, the program will core dump and create a root owned 600 perm core in the current directory.