Leading 'maybe' to an RCE, i imagine you need to groom the heap first, unless there is something i'm missing.

Edit: also thanks for using RCE correctly, it seems to be any kind of code execution these days is considered "RCE".. boo.