A nice video has been maded on reversing WMF exploit code
hxxp://www.websensesecuritylabs.com/images/alerts/wmf.html

regards, Lownoise