With help subsystem it's possible to execute code with LocalSystem privileges.
vulners.com/securityvulns/securityvulns:doc:9588
vulners.com/securityvulns/securityvulns:doc:9622