Why? You can always send a message back to tell the callback requestor something has occured/completed. You can still do callbacks between processes in an application. Granted it will break some apps, and require extra code in COM+ (create local proxys ahla network OLE, er ActiveX, er COM, er Windows RNA (renamed network architecture)).
In this case it seems the problem is being able to put arbitrary data into another application's memory then being able to jump to an arbitrary place in that code. Perhaps 'mangling' pointers that should be GPF bait to begin with is a solution (of course you would have to consistantly unmangle them where appropriate). That's such an ugly solution MS might like it.