Presumably just set to a canonical crash in the lookup table of address-to-code; which still get you a crash, just not that of the directly-run invalid code.