I think the exploit would have something to do with the PNG profile picture upload feature, I've figured out how to upload my own files but not sure what I can do with this.