This vulnerability is no longer unknown, though it is (to my knowledge) still unpatched. It is known not to be exploitable on IE7 with DEP enabled, so most IE instances should in fact be easy to lock down.
In any case, this vulnerability looks remarkably straightforward. You could conceive of the fuzzer that might have found it. It would be an extremely clever fuzzer, but not an unprecedented one.