the short explanation is that you force it to fail to boot by cutting power, boot again, and allow it to go into error checking/recovery mode. you have to let it do the whole error check thing but once it's done, it'll say "no errors found". then you click a link to "see a more detailed report".
it opens in notepad. file->open, navigate to system32, right click on the sticky keys executable and rename it, right click on cmd.exe and make a copy, rename the copy to the sticky keys executable's old name, reboot
now, before logging in, just tap shift 5 times to get a root console
@monorail you should post the video with the 98/XP exploit that uses the printer menu and the help system to get past the login, it's wild