Yup. And since applications load DLLs from their working directory by default, and opening a document sets the working directory... you'd better make sure you never open a document from an untrusted folder.