I think he must already have code execution, and just used this technique to dump bits of RAM.

Perhaps it it was a shellcode exploit, he maybe only had a few hundred bytes of his own code to play with, and maybe no knowledge of memory addresses needed to access 'easier' peripherals like serial UART's.