The victimn should visit the site and accept to run the applet in your computer. Then if the JVM is vulnerable the cracker can execute arbitrary commands.
So my question is: How did the security researcher find this vulnerability? I mean, not specific this one, but how (what tools, method, etc) did he/she use to find these vulnerabilities? Does he/she reverse engineer javaw.exe? What's the methods?