I would imagine it works almost exactly the same as the IE exploits....there was a link that demonstrated the vuln for IE in the bugtraq mailing list. I will post it tomorrow......