If a hacker injects code onto a stack, and can set a programs return value to point to a desired address---but he can't figure out where his code has been injected. What can said hacker do to execute said code?