The fragmentation relies on an offset value in each fragment to determine where the individual fragment goes upon reassembly. Since typical machines don't process the packet until they have all fragments and have tried to reassemble it, there is the possibility for overflow of 16 bit internal variables, which can lead to system crashes, reboots, kernel dumps and the like. With all this talk of ping, it's easy to miss the root of the problem. Joel Maslak has pointed out that this exploit is by no means restricted to ping. The problem can be exploited by anything that sends an IP datagram - probably the most fundamental building block of the net.
Bottom line is that blocking ping at the firewall is a temporary fix only.
The only solution is to secure the kernel against overflow when reconstructing IP fragments. So don't thing you're safe just because you've blocked ping. Unfortunately, this bug is really easy to exploit. Apparently, according to Volker Ossenkopf, the ping command on Linux can be rebuilt with a higher package size limit in the ping source, and used to whack machines too. Remember, Linux Ping must be run as root.