Please search this ARM silicon errata document for entry 752770. Several instructions that load the SP may work incorrectly. Please verify that code generated by the compiler is not affected by this bug.

Update:
The ARM RTS does actually include one of the instructions listed in the erratum 752770 (Cortex-M4) as part of TDEH (table-driven exception handling) unwind. Within "__TI_Install_CoreRegs" in tdeh_uwentry_t2.asm, there is an explicit indirect load to destination register R13 as part of the assembly sequence. But this is not generated by the compiler itself. Curiously, the same sequence in tdeh_uwentry16.asm uses the suggested workaround (load to another register and move the value to R13). I filed a defect to fix this on the ARM branches.

The compiler will not generate the instructions listed in the 752770 errata (Cortex-M4), neither inadvertently nor intentionally. The SP is specifically excluded from any save-on-entry or save-on-call set, preventing it from being inadvertently saved or restored. It will never be inadvertently spilled/restored. It is also specifically excluded from the ISR routine SAVE set. Further, in the compiler, there are no instances of intentional or explicit usage of the SP as a load destination register (unlike the LR and PC registers).

Enless exception handling is being enabled, the customer is safe from any code related to the erratum.