Everything you wanted to know about the VML exploit, but were too afraid to ask

Juha-Matti Laurio does the hefty lifting, with an extensive FAQ here.