Open up the temporary file for reading. There's already one defined, and it's the one which is trying to load the other thing. It also preserves relocation information. When you call this stub, it then tracks down the function, grovels through core once more to nab all the pointers into it, and then falls into it.
All future calls go directly into it.
In short, it's possible to do, if you don't mind maintaining a symbol table in your executable. But it's a neat hack. This method cannot deal with stripped binaries, which most system programs are. Instead of stub routines, you could instead just use invalid pointers, and trap the bus error that results. That's what Multics does.