Comment by moonchild

Very cute! A related trick—which I believe has been used by at least one gc's read barrier—is to turn a branch into a load from an address which will be unmapped iff the branch should be taken.