Aren't most UAC bypasses relying on the fact that UAC by default isn't "full sudo"mode - i.e. it allows certain things without prompting?