This proof of concept exploit triggers a crash on Windows 7 32-bit with Special Pool enabled on win32k.sys. The kernel crashes due to a use-after-free condition with bitmaps in the clipboard.
01bafe1c271dd2a2ea9fadc32ab4da411c8c4eb30209e6634fd69a20fc0c4443