I enjoy the idea of return oriented programming, piecing together an exploit from your host app's binary.

Worth noting that they didn't break out of the sandbox, an app downloaded from the App Store could get access to the same data they did.