Compromising a host with pf enabled?

[Clint Pachl]

Is it possible for a cracker to compromise or root a machine on a 
network that has pf enabled with the single rule "block all in"?