http://www.crn.com/news/security/226900204/microsoft-warns-u...
has a bit of detail, but not specifically about this attack.
I guess it's conceptually similar to doing something like
export PATH=.:$PATH; cat foo.txt
The actual linux equivalent would probably involve $LD_LIBRARY_PATH ($DYLD_LIBRARY_PATH on OSX, not sure about other unices).
https://community.rapid7.com/community/infosec/blog/2010/08/...
http://blogs.msdn.com/b/david_leblanc/archive/2008/02/20/dll...
http://www.n00bz.net/blog/2010/9/15/dll-hijacking-with-metas...
Not sure how the network drive part would fit into that hypothesis, though.
This is all just speculation. I don't code for Windows, and I don't know anything more about this vulnerability than what's stated in the advisory.
(As was commented on below, this is identical to an LD_LIBRARY_PATH type exploit on Linux; here is Microsoft's fix as well as an explanation of how it works http://support.microsoft.com/kb/2264107)
Edit: I realize now literally any URL could be a WebDAV site with a text/plain mime type and an exploit DLL in the same dir. So really, every single URL you hit with IE is potentially vulnerable. Have a nice day.
From the description of the vulnerability, it sounds as if the culprit is some code mounting documents over the network, and so just opening a readme.txt in the local directory will not trigger this.
"For an attack to be successful, a user must visit an untrusted remote file system location or WebDAV share and open a document from this location that is then loaded by a vulnerable application."
Since a ZIP file would extract to a local directory, nothing would happen.
All the stuff about WebDav being necessary for a successful attack is because they're assuming someone can't drop a DLL onto your system. But if you unzip a package with a README.txt in the same folder as a DLL you would be vulnerable.
I remember creating a fairly unsuccessful "text file virus" that would try to copy itself around our school network and reboot people's machines. Good times...