... I feel compelled to point at Derek Soeder's VMware Emulation Flaw x64 Guest Privilege Escalation (1/2) post at full disclosure. It seems that it's always the same names that come up with those beautiful exploits. Delighting.