在下面的代码中，我注入了自己的指令来修改sprintf()函数的第三个参数，但该过程在 EXC_BAD_INSTRUCTION 处停止。谁能告诉我我的代码中发生了什么？

0x144502 <+6>:  movw   r0, #0xc70       ; injected code start here
0x144506 <+10>: movt   r0, #0x8bb3
0x14450a <+14>: movw   r3, #0x576
0x14450e <+18>: ldr    r1, [r7]
0x144510 <+20>: movs   r5, #0x1a
0x144512 <+22>: add    r5, pc           ; next instruction will jump over 9 instructions
0x144514 <+24>: bx     r5               ; pc = 0x00144514
                                        ; r5 = 0x00144530
0x144516 <+26>: ldr    r1, [r0]
0x144518 <+28>: ldr    r0, [r2]
0x14451a <+30>: blx    0x29111c
0x14451e <+34>: movw   r1, #0x6442
0x144522 <+38>: movt   r1, #0x18
0x144526 <+42>: add    r1, pc
0x144528 <+44>: ldr    r1, [r1]
0x14452a <+46>: blx    0x29111c
0x14452e <+50>: mov    r3, r1
0x144530 <+52>: movw   r1, #0x66a4      ; bx r5 landed here. But r1 has not been loaded
0x144534 <+56>: movt   r1, #0x15        ; with new value. Why?
0x144538 <+60>: mov    r2, r0
0x14453a <+62>: add    r1, pc           ; this instruction never get called
0x14453c <+64>: mov    r0, r4           ; EXC_BAD_INSTRUCTION raised here
0x14453e <+66>: blx    __sprintf