When does viewstate stop CSRF and when does it fail to do so?

[Moncler Jackets]

Under what conditions does having a viewstate in a request prevent CSRF attacks? This exploit claims that even though a viewstate is present in the request, it is still vulnerable to CSRF. However the exploit doesn't explain why this is the case.