Yeah, we've had a similar submission before with the same issue.  Can't remember who submitted it, but he never found another application-specific DLL for the exploit to be reliable, and we ended up rejecting it.  The only reliable way to exploit FreeFloat, really, is to upload your malicious exe to system32 and use the WbemExec trick to get a shell -- which we have already.