Why Changing The Order Works (Continued):

To patch a trap (i.e. to become a part of the process that occurs when a program calls a ROM routine to do something), an extension remembers the address that is stored in a table, and puts its own address in that table.  

When the related ROM routine gets called, the program execution jumps to the address that the system extension put in the table. The system extension does whatever it wants, and then jumps to the address that it remembered from the table (i.e. the real ROM routine).