Erik,
there could be reasons to manipulate return addresses.
I did such a design a few years ago with an 89c52 and an external flash with update code (flash was mapped to 0x4000 in X and C Data space.
There I had to change the return address on stack to fix some firmware errors in the 89c52. It saved us a large amount of shipping costs.

But I agree with you in general its bad design (and very hard to debug)

Thomas