Also note that it doesn't even have to be an active theme - since timthumb.php executes directly and not through wordpress.