This is a whitepaper that discusses using heap sprays with vulnerable active-x controls.
You can download it from the following link: https://packetstormsecurity.com/files/download/124828/heapspray-activex.pdf
Source: https://packetstormsecurity.com/files/124828/Heap-Spraying-Active-X-Controls-Under-Atatck.html