> indexing the array you can have unrestricted read/write access to a large section of memory.

but won't the memory protection (write xor execute) stop the function pointer from jumping to the array body (since that's write memory)? Meh, i guess in actual practise, it's much more complicated than that...