Additionally, people who attended my talk at the CanSecWest event last
year may remember that it is possible (although not trivial) to exploit
this kind of "out of memory crash" bug to actually run arbitrary code on
some operating systems.

This is explained in the slides at :
http://cansecwest.com/...

[ more ]