Paper discussing more shatter attacks that are possible using SEH memory locations to escalate privileges in Windows. Related information available here.
You can download it from the following link: https://packetstormsecurity.com/files/download/31358/shatterSEH.txt
Source: https://packetstormsecurity.com/files/31358/shatterSEH.txt.html