Having written a few toy VMs in the past (and some in production!), there are always avenues to "make it weird."
Sol's yield/end instruction pair looks super abusable if you want to write somethiing obfuscated.
My favourite alteration has always been to not have any control flow instructions in the provided ISA, but allow the programmer direct write access to the program counter register, or force them to write self modifying code.
After all, programming is fun.
I did that for a toy RISC ISA of mine, but I added the additional soft constraint of one assembler temporary. It turns out that’s enough to macro-code most control flow instructions in the assembler even if your instruction set is very poor, so it’s really not a huge barrier in practice. (You jump into the middle of a branch island, which performs the test and scales it so that it is large enough that the -1/0/+1 result is enough so that pc+that value is enough to reach all three arms of the condition.)
call 0
pop eax
shl eax 1
jmp eax