I read up on it, and it works using a heap overflow by emulating a USB hub, and by some fake USB magic it pushes unsigned code into memory and it gets executed, I think because one of the fake USB IDs indicates a device firmware upgrade of some sort and the PS3 "expects it". I doubt that a "special USB key" from a developer's unit would do the same thing, but if so, someone at Sony is very clever.