Sandbox everything, in effect. I already have a dozen or so different VM's for different types of projects mostly because it's easier to reproduce environments that way, but if there was even a remote chance of something like this, I'd sandbox every untrusted app.