From what I understand, a lot of fuzzing and debugging is required following the advisory to successfully develop the exploit code. The advisory at least gives the exploit developer a hint or two so he has an idea where to go when debugging. An hour or so later and he is publishing the proof of concept code to some public 0day database.