One exception may be if you could steal an authenticated pointer to a buffer that's about to have some generated machine code written to it (e.g. for JIT execution), and use that to write your own arbitrary code instead.