The short story is that this issue turned out to not be exploitable for remote code execution. It was a PowerPoint crashing bug not a PowerPoint security vulnerability. The PowerPoint team has developed a fix for this bug and it will go into the next available ship vehicle for PowerPoint. The longer story is below.