I'm not really qualified to answer any of the questions, but since no one else does, and in a hopeless attempt to prevent this place from total brain death, here goes so far as it concerns Canon P&S and CHDK:
(1) You dissected it, so you should know better than anyone else
(2) CHDK exploits the firmware update mechanism of Canon P&S cameras, which, in one of its two alternatives, indeed uses SD as a sort of bootdisk. In which case (and I read that a similar mechanism can be activated in some EOS models), it works roughly as follows: If the card contains DISKBOOT.BIN in the root and conforms to some other requirements, then, at startup, DISKBOOT.BIN is loaded and run -- so, we're up and running. Then, some magic is performed (yes, by CHDK and foremost in the "loader") to restart the operating system of the camera while maintaining a copy of our code in the memory and hooking into the operating system as it starts. Note that NO PERMANENT CHANGES are made to the memory. For more detail (rather comprehensible), see, e.g.,
http://chdk.setepontos.com/index.php/topic,1454.0.html and
http://chdk.setepontos.com/index.php/topic,234.msg1521.html#msg1521(3) Correct
