If you are really worried about the performance issue (minimal) of a symlink, then you could always use a bind mount instead. You also, will not have any of the security implications either. A bind-mount is basically a symlink that exists purely at the kernel level.
But you probably shouldn't really be worrying about the performance aspect unless you have proof that it is a real issue.
Also, actually enabling symlinks in Apache actually improves performance in some cases, because some filesystem checks are removed. Unless you have a reason to have it disabled, you probably want FollowSymLinks on.
See the performance tuning section about symlinks in the Apache docs. http://httpd.apache.org/docs/2.2/misc/perf-tuning.html#symlinks
FollowSymLinks and SymLinksIfOwnerMatch
Wherever in your
URL-space you do not have an Options
FollowSymLinks, or you do have an
Options SymLinksIfOwnerMatch Apache
will have to issue extra system calls
to check up on symlinks. One extra
call per filename component.
The security implications of FollowSymLinks tend to be all centered around permitting non-trusted users the ability to create files. If you are on a shared server, if you permit non-trusted users to write to the filesystem, or if you have any bugs in any hosted webapps, then a hostile user could be create a symlink to a file that wouldn't normally be available via the web server. They could display it, or if your permissions are really bad, and you have a buggy webapp, then a symlink could permit modifications. On a system that is well locked down this shouldn't be that much of an issue. If you have any directories where you permit store user-supplied content, you should disable symlink following there.