Tweet has been deleted: https://twitter.com/i0n1c/status/738258436161449984 I deleted the tweet with the picture of the sandbox because people start hyping it up without linking the clarification. And the "clarification" tweet: https://twitter.com/i0n1c/status/738084828202053633 For those late to the party: the sandbox bypass exception for Blizzard only affects the access() family of syscalls - probably harmless Edit…
I Google'd and here is one result, showing at least one theoretical security vulnerability of access(): http://stackoverflow.com/a/14333217/3650441 If an attacker knows what files Blizzard is calling access() on, they could likely use this exploit and execute arbitrary code.
Could they though? The way I understand the answer is that the security hole happens if a privileged user which manipulates files for an unprivileged user calls access() and then open(). In this case Blizzard's application is an unprivileged user, thus even if you manage to insert yourself between the calls, you will only be able to make Blizzards application execute code. The application still runs in a sandbox so you will not get that far.