UAC is not a security boundary, its simply a UX feature. The only reason that so called 'exploit' works is because the logged in user already has admin privileg

UAC is not a security boundary, its simply a UX feature. The only reason that so called 'exploit' works is because the logged in user already has admin privileges. I would not categorize it as an exploit, but yes interesting. Its similar to popping up a fake authentication screen and asking the user to type their admin password.