Well that's ugly. Embed a JS redirect via some XSS to a server running that wincrasher script and you could start bringing down a lot of boxes out there.
Hope this is fixed asap. I'm just starting to really like Win 7.
Can you even hit SMB shares over the internet? Seems to be that the malicious computer would have to be on the same network for this to work.
Indeed you can. Try \\live.sysinternals.com in a Windows Explorer window for an example of it (presumably mounting it in linux would work as well, although I haven't tried).
In theory yes, but many many consumer ISPs filter the TCP ports required to do this, so it might not be as successful as one would expect.