eEye Security Advisory - Windows VDM #UD Local Privilege Escalation. Describes in more detail but with different terminology the "shatter" attacks corrected by MS04-032, and also discussed in a paper by Brett Moore.
6d969851dce47717c7c8d2b34a7d86e3e4b6339359ea1b5ff2767ce9961e7872
This paper gives an example of the variety of shatter attack which should be corrected by MS04-032 (KB840987). This sort of attack can typically be used for local privilege escalation.
b85c177e413daeba0b079bcf4270af5caa8ea90d4ca38f90165174415a48ef12