You can use CreateThread ***IF*** if you have the main thread call it. Otherwise They have a check on the calling ( and probably return address ) of CreateThread / NTCreateThread. Also, threading isn't completely necessary, there are other ways to run arbitrary code within the target process ( crossfire for this discussion ) =)
I'll let you guys think about that one though.
-Pyro