He was using the explanation of printing VS viewing as a reason why MS MIGHT have screwed up and done it by accident.

If a file is going to the print subsystem, there is the possibility that the job will need to be aborted after the hand-off. So there is the ability to drop a callback into the file that will allow the print subsystem to check if it has been aborted. The callback is a 4 byte address in the submitting program's memory space, which hold a routine, and will tell the print subsystem whether the job should be aborted.

This is a different.

In this case, there is an illegal instruction in the wmf file that is VERY unlikely to be there by accident. It essential saya that the length of the data to follow is 1 byte, but since it is dealing in words is must be at LEAST 4 bytes. Combined that with the abort instruction. And then, rather than jump to a callback (which would be appropriate if this was a mistake, ie: cut-and-paste of the underlying code that make no sense for viewing rather than printing), start executing code contained within the image file.

This also means there is no return to current operation, since the stack is destroyed,