I haven't seen it either, but it should be doable as you describe. A TSX will transfer the stack pointer to the X register, so that would tell you where to start inserting the pointers you want to "jump to" on the next RTS. There's nothing to stop you writing directly into the stack page, other than sanity.

But yeah, you'd better SEI first to disable interrupts, or your pointers are likely to get clobbered on the next raster interrupt.