Hmm, I wonder if a PDF file is actually needed for a font exploit. What about the trend of every fucking website now to ship their own fonts?
Also, lots of people simply pirate their fonts from googling around "fontname ttf free download", I wonder how much malware hides in these - given that I somewhere have around 16 or so copies of some exotic Adobe font in various formats, one buggier than the other.