The user manuals always said don't switch the EA pin on-the-fly. The main reason is that you need to know when to time it. It was later discovered that this was a security hole using MOVC so manufacturers decided to latch the EA pin when you come out of reset if the read inhibit security bit was programmed. I actually have done this with a competitor's 80C51 part a long time ago - just for fun to see how easy it was to read their code using MOVC. It wasn't difficult (maybe I can find my notes from then) but I also had the resources of a chip designer who told me the timing window when to change the EA pin during the MOVC instruction.(I think a few devices in the industry latch the EA pin always coming out of reset). I have not switched the EA pin on the fly before on the Rx2 devices. I'm going to try it. Since there is a bit to prohibit external execution, I doubt that the EA/ pin is latched if no security bits are programmed. As to the timing, after fetching the third byte of a LJMP is the correct time. I, and the 8051, don't care if it corrupts the fourth byte because the CPU ignores the fourth byte fetched on a three byte instruction. I'll try it an let you know how it works.