In fact, there's an entire class of kernel exploits where if you know a certain kind of behavior will cause the kernel to dereference 0x0, and that system allows you to mmap the lowest page in your virtual address space, you can take over the machine.

See https://blogs.oracle.com/ksplice/entry/much_ado_about_null_a... and https://blogs.oracle.com/ksplice/entry/much_ado_about_null_e...

(dkersten, I assume you know this, I'm pointing it out for the benefit of others.)