2) VENDOR STATUS:
==================
Microsoft was initially contacted 2002-10-04. After several mail
exchanges, their final response were that the technique used to run
programs with parameters from the "Local computer zone" was no security
vulnerability. A fix should instead be applied for all possibilities for
content in the "Internet zone" to access the "Local computer zone".

So basically M$ is saying it's not a hole. So I would assume no, no fix available.