[Full-disclosure] i've found an exploit, but i want to make it do something before i report it

[ima cow <i-am-cow@xxxxxxxxxx>]

i understand that this is "full disclosure", but before i actually spill the 
beans on the exact nature of the exploit i've found, i'd like to make it 
actually do something.
for now, know that it affects a popular plugin for a popular messaging program.
i'm at the stage where i can run any command on the remote user's computer 
(just like start > run...), or have them request remote assistance.
other than showing them goatse, what can i do with this?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/