By surface area, Grossman is referring to the principle that the probability of successful attack increases as more of a system's security boundary is identified. 1
- The ability to transfer execution to one of the objects instantiated during parsing
Depending on the conditions prior to the attack 2, one or both of those mechanisms may already be in place, therefore not requiring that particular breach. 3
The direct answer to the question is that the various documented XSS attacks can be used to accomplish either or both of those breaches. Which ones that might be used will depend on the details of the surface Grossman mentions.
There is an example in the comment from @rápli-andrás, and here is a good overview with more code examples.
 Once a breach occurs, if there is no further security surface, the attack is complete. Otherwise it is partial, which still may facilitate the attacker's objectives.
 Conditions include the design of the system and its current execution state in the browser and server.
 This may have contributed to the vulnerability with the Google Reader.