As a followup, someone finally did find a full-blown 'execute whatever you like' exploit for the patched version of bash.

http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-...