Pretty much all those examples, but the real danger is chaining this exploit with others

Perhaps someone is sitting on a couple exploits to get them into a system, but only to an unprivileged user, this would be a great final act