I just listened to the whole thing. I am a programmer, and it sounds plausible. He defends his position very well. However, Gibson is known for false alarms (raw sockets, anyone?), so I'll have to wait before believing this until Gibson finishes his analysis and we hear the reaction from other credible researchers.
The point that interested me was the fact that the WMF interpreter was starting as separate thread to execute the embedded code.
To me, this shows intent to execute something, and is not the way a buffer overrun would work.
I will admit that Steve is a bit of a self promoter, but we have a few of those here, as well. And it doesn't make them necessarily wrong.