I'm asking mostly out of idle curiosity.
When using TestComplete, I've noticed I can point my script at an arbitrary running .NET application, grab a control, reflect on it, and even call methods on it. I have no idea how they pull this off. This isn't simple UIAutomation, as far as I can tell, since I can grab private fields. Also, this isn't remoting, because the app has no extra hooks.
How can I get a hold of another .NET object running on another process and call into it?