It is possible to spawn a process that will run at a higher privelaged user....a good example running Symantec's Live Update as a restricted user giving that user access to a command line that runs with System privelages. The only real way to defend against this type of thing is to keep all software patched and updated and log certain types of events.

EDIT: Cool....275! I'm addicted!