Upon further investigation, because that's how I am, I've confirmed that Hyper-V (on a completely different host system) behaves the same as VMware for me. The heap spray ends up at addresses to high to allow exploitation.
But for Stephen, both VMware- and Hyper-V-based ICS systems start heap spraying low enough to allow exploitation.
Neither one of us can figure out why this is the case.