(As was commented on below, this is identical to an LD_LIBRARY_PATH type exploit on Linux; here is Microsoft's fix as well as an explanation of how it works http://support.microsoft.com/kb/2264107)
Edit: I realize now literally any URL could be a WebDAV site with a text/plain mime type and an exploit DLL in the same dir. So really, every single URL you hit with IE is potentially vulnerable. Have a nice day.
http://www.crn.com/news/security/226900204/microsoft-warns-u...
has a bit of detail, but not specifically about this attack.
I guess it's conceptually similar to doing something like
export PATH=.:$PATH; cat foo.txt
The actual linux equivalent would probably involve $LD_LIBRARY_PATH ($DYLD_LIBRARY_PATH on OSX, not sure about other unices).
https://community.rapid7.com/community/infosec/blog/2010/08/...
http://blogs.msdn.com/b/david_leblanc/archive/2008/02/20/dll...
http://www.n00bz.net/blog/2010/9/15/dll-hijacking-with-metas...
Not sure how the network drive part would fit into that hypothesis, though.
This is all just speculation. I don't code for Windows, and I don't know anything more about this vulnerability than what's stated in the advisory.
From the description of the vulnerability, it sounds as if the culprit is some code mounting documents over the network, and so just opening a readme.txt in the local directory will not trigger this.
"For an attack to be successful, a user must visit an untrusted remote file system location or WebDAV share and open a document from this location that is then loaded by a vulnerable application."
Since a ZIP file would extract to a local directory, nothing would happen.
All the stuff about WebDav being necessary for a successful attack is because they're assuming someone can't drop a DLL onto your system. But if you unzip a package with a README.txt in the same folder as a DLL you would be vulnerable.
I remember creating a fairly unsuccessful "text file virus" that would try to copy itself around our school network and reboot people's machines. Good times...