I know how the reference exploit works, but that's not the only way to exploit the bug.