This blog post could not find an exploit, but proved enough that there could be. The theory is that the KAISER researchers took this idea and found a way to exploit it.