You think RISC sounds like a good idea now.. wait until you read about "return-oriented programming" with variable length instructions!

http://cseweb.ucsd.edu/~hovav/talks/blackhat08.html

The short story: arbitrary computation by finding 'ret's wit short sequences of useful code before them. Finding them in your code, and they need not actually be 'ret's thanks for the same reason this stuff works.