By using small memory regisouns it's possible to place executable code into non-executable memory regions.
vulners.com/securityvulns/securityvulns:doc:7714