This can be exploited by creating a file together with an OLE object in such a way to cause MAPI to load a DLL from a network share when the OLE object is activated.