PrintDemon allows a low-privileged user to create a printer port pointing to a file, and then print to that port. If the user has insufficient permissions for writing to said file, Print Spooler service will do that as Local System upon computer restart.
A company named 0patch is providing patches and workarounds for this and other similar issues, some of them for free. For an updated list of these patches, see:
What I failed to understand up to now is the easy way to install at least the free ones...