Well, that's sort of true. You don't necessarily have to keep track of the runtime memory as long as the buffer is large enough.

You could find the address of a JMP %ESP instruction in the victim OS (0x7C8369D8 in XP SP 2) and place it before a NOPsled.

A typical buffer overflow, for example:

[AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA][0x7C8369D8][NOP][shellcode]

You do, of course, need to make sure you don't have any \0 bytes in your shellcode, but that's always been the case.