Oh OK, then I did see correctly after all. But still, on many modern systems (e.g. with non-executable stack) it would require fairly sophisticated trickery in the payload to make this do anything. I mean, getting control over EIP is a very good first step, but this isn't 1995.
Having access to EIP means you have full control. From there it is very simple to do return to libc or ROP attacks. EIP is the holy grail, control that and you win.
