When doing exploit development, the process always relies on memory address from the victim's machine.
As an exploit developer, you will have to setup an environment of attacker\victim machines and try on it. The main leads for the exploit developer in his journey toward getting a shell from the vulnerable app are the memory address (DLLs and buffer locations mainly) which he gets from attaching the app to a debugger (usually pointed to by CPU registers such as EIP , ESP , etc).
This is good if the final goal is to make a proof of concept code to prove that this app is vulnerable. However,as far as i know, those address are not permanent and can change from machine to machine. If you're doing black box Penetration Test for a company, you wont be able to attach a debugger to their application in order to get the right addresses to jump to. And the same applies for public exploits from exploit-db because most of the exploits there need some fixing regarding addresses and offsets.
So my question is: how does a penetration tester benefit from writing such exploits (or downloading one from exploit-db) as a penetration tester not as an exploit developer?