There are vulns that aren't fixed that by themselves don't seem so bad, but in conjunction with others are. And there are examples that aren't fixed today. Fo

There are vulns that aren't fixed that by themselves don't seem so bad, but in conjunction with others are. And there are examples that aren't fixed today. For example, there's a disclosure of information bug in IE8 that exists, but you need the location of the target file to exploit it. If there's another exploit that lets you drop files outside the sandbox, and another exploit where you can overflow a buffer outside the sandbox on reading a file, you now have three vulns that together get you to run code, but any two of them is not sufficient. Note, I based this on SA38416, despite the fact that it appears possible/likely that this vulnerability actually doesn't exist as stated, but it was fine for expository purposes.