That's right. But it's more difficult to exploit, because you have to smash the caller's return address, not your own, and then wait for the caller to return. Anyways, my point is merely that if you wanted to design an ISA that maximizes exploitability of buffer overflows, you'd be hard pressed to do better than x86.