CASSANDRA-5547, we made cleanup (among other things) run in parallel across multiple sstables. There have been reports on IRC of this leading to disk space exhaustion, because multiple sstables are (almost entirely) rewritten at the same time. This seems particularly problematic because cleanup is frequently run after a cluster is expanded due to low disk space.
I'm not really familiar with how we perform free disk space checks now, but it sounds like we can make some improvements here. It would be good to reduce the concurrency of cleanup operations if there isn't enough free disk space to support this.