Reminds me of the trick that was first used to make a TI-85 execute arbitrary assembly code. Someone disassembled a ROM and found that the CUSTOM menu was actually implemented by an unchecked jump to (presumably) the code of the function the user selected. Normally, the interface will only let you select built in functions, but by hacking a RAM backup, it was possible to make it jump to the data held in a STRING variable and execute it as code. Typically, this was populated with a bootloader that executed a shell stored within a PRGM. That shell provided a menu to execute arbitrary other code also stored in PRGM data.