Arbitrary code execution to convert Super Mario to Flappy Bird, done entirely by hand on a real device!
https://youtu.be/hB6eY73sLV0
The first exploit modifies the UI to show exact sprite co-ordinates (used for the payload), then the new game is 331 bytes written with spin jumps!