jump to MMIO address In the ARM architecture, what happens on executing a jump instruction whose jump target address is an MMIO address (or in paging mode, a virtual address that is mapped to an MMIO address)? 
Would this such an instruction abort?
If it succeeds and sets the EIP accordingly, what happens next: Will the CPU actually fetch the next instruction by reading MMIO address (which may be connected to a peripheral device)?

If it succeeds, reasoning about such a CPU seems problematic because reads and writes to IO addresses are potentially visible to the outside world, unlike DRAM. For example, the effect of out-of-order instruction prefetching will be visible to the outside world via IO.
The MMIO is read into instruction cache, and the code executes as normal. The instruction cache assumes that the contents of memory underneath it do not change unless the cache is explicitly flushed.

Not only does this work, it's common practice to execute code directly from flash devices in very small embedded applications.