[tinus_hn]

The return address is on the stack so if you push data and then return, that data is now interpreted as an address to jump to.