The Frame Pointer Overwrite

This article written by klog demonstrates it is possible to exploit stack overflows even under the worst conditions. Many esoteric techniques where the goal is to exploit trusted processes in the most hostile situations exist, including when privileges are dropped. This paper covers the one-byte overflow case.
http://doc.bughunter.net/buffer-overflow/frame-pointer.html