It's also worth remembering that a complete exploit can often compose numerous "small" vulnerabilities into the realized breach. As such, it's easy to discount a seemingly hard-to-exploit vulnerability until you see it in action. It may be used in concert with other weaknesses or "widened" by an unforeseen technique.

As a specific example, check out the two-part wrap-up of the Pwnium browser hacking competition[1] [2]. It's a great illustration of chaining weaknesses together to achieve a desired exploit.

[1] http://blog.chromium.org/2012/05/tale-of-two-pwnies-part-1.h...

[2] http://blog.chromium.org/2012/06/tale-of-two-pwnies-part-2.h...

Oh wow, that guy exploited 14 bugs to craft the exploit. That's some work...