That's not trying to break the mitigations: it's simply testing if they stop an exploit which isn't designed to bypass the mitigations. Really easy to pull off. :) Below are examples of a clever scheme for stopping control flow attacks and a successful attempt to breaking it. When I say testing the mitigations, I mean work like what's in the second paper.
https://www.usenix.org/system/files/conference/usenixsecurit...
http://www.cs.berkeley.edu/~daw/papers/cfi-sec15.pdf
Note: Native Client, which protects Chrome, is a form of Control-flow Integrity. Hence, me using it as an example.