[codeflo]

How can a reusable function have a fixed return address?

[tsimionescu]

This is a good point that I hadn't considered - these are indirect jumps, and the return instruction has special handling from the processor to compute the address specifically, which a jump to a recover address can't have.

[eptcyka]

Because of the stack? It is not fixed, but once you a function is called, the CPU must know where it was called from.