Mark,
As long as the lower 18 bits of the address don't match, you'll avoid this bug.
So, for example, if you map the memory in the standard way (flash starts at address 0x0, Ram at address 0x20000000) and you don't use the lower 32k of flash, you will avoid this bug. I've done this successfully, and it worked out great for me because I've got a bootloader that lives in the lower 32k. So what I do is disable speculation in the bootloader (workaround 1) and then, in the application, re-enable it.
Joshua van Tol
Watlow Controls, Inc