And you could just send them an email, carefully tailored to target them, with a link to your exploit site.