Very cute! A related trick—which I believe has been used by at least one gc's read barrier—is to turn a branch into a load from an address which will be unmapped iff the branch should be taken.
I didn't understand the idea. Can you please provide more details?
You encode the test condition in address `ea` and execute some quasi no-op like `test eax, [ea]`. The address space is setup such that `ea` is unmapped / unreadable if the test condition says the code should trap.