It was possible to take an interrupt on the instruction in the shadow of a short forward branch. EPC would thus get the wrong value, and so a wrong-path instruction would be executed upon return from interrupt. h/t Yunsup