Ok, after looking at some of the code and discussing with mx3, some of the code is NOT relocatable.
There is [admin: avoid swearing please] like ldr pc, constant.
I have no clue why that is there, and why the compiler didn't just generate a B instruction. Since all the instructions are the same size, and the jump location is (obviously) not outside the +/- 32MB limit, it should be relatively easy to have a program replace all that code with B.
Now, of course, there are two problems:
1. Cases where PC is not loaded with a direct constant.
2. Cases where data is intepreted as code.
But I think it could be done on a PC, where there are no memory or speed restrictions.