I don't know the details, but a fully attacker controlled EIP sounds likely to be exploitable doesn't it? Possibly data leakage from the browser, maybe arbitrary execution if the attacker is lucky. This sounds likely at the least to put an attacker in a better place to socially engineer a user into installing malware.
If you can control EIP, you can run arbitrary code, period. It might be difficult depending on whether ASLR is in use or not, but it can always be done.
Long answer: It depends on what you define as arbitrary code execution. In a good number of cases, you can use ROP to execute whatever "code" (made up of little bits of existing program code repurposed for your needs) you wish, and accomplish whatever you want to accomplish. In many cases, this is finding your "real" code and setting memory protection such that you can jump into it. In effect, if you have control over EIP, you've already owned the system; it might not be easy to do everything you want to do, but it's effectively always possible.
Interesting, thanks. According to Google, ROP is return-oriented programming, where you build up a program by jumping to near the end of existing executable subroutines. The control flow comes from corrupting the stack with a list of the addresses of this code. The example here:
