In the security paper, they highlight that the entertainment system displays radio station images that are broadcast over the air (not sure if this was FM or satellite). So it's conceivable that an FM transmitter could broadcast a corrupt JPEG, causing a buffer overrun in some crappy image decoding software, and pwn your car...