Is there any, any whatsoever, evidence to say that this exploit has ever been exploited?

It seems far fetched. And if your using a virtual keyboard for security... you'd be using IE? C'mon now.