http://cseweb.ucsd.edu/~hovav/talks/blackhat08.html
The short story: arbitrary computation by finding 'ret's wit short sequences of useful code before them. Finding them in your code, and they need not actually be 'ret's thanks for the same reason this stuff works.
Variable-length instructions, when done right, closely approximate Huffman coding your binary, so you can get big code size wins, but there are definitely hardware/system software complexity and security disadvantages to be aware of. An intermediate point between, say, MIPS and x86, is something like ARM's Thumb, where you have one set of small instructions for your most common operations, and you can distinguish between the two in hardware without much hassle.
However, this doesn't work for a legacy architecture like x86, because many of the short opcodes are no longer the commonly used ones. Some are even actively deprecated. So overall, ARM wins in code size. I'm not sure about x86/64, maybe it is better there...