Proof of concept - Still looking for a better route. One that directly overwrites the program counter without needing ACE may still be possible.