I finally found in the Technical Reference Manual, in section 26.1.3.2 Public RAM Memory Map, the following paragraph:
The RAM exception vectors enable a simple means for redirecting exceptions to custom handlers. Table 26-3 shows content of the RAM space reserved for RAM vectors. The first seven addresses are ARM instructions which load the value located in the subsequent seven addresses into the PC register. Theses instructions are executed when an exception occurs since they are called from the ROM exception vectors. Undefined, SWI, Unused and FIQ exceptions are redirected to a hardcoded dead loop. Pre-fetch abort, data abort, and IRQ exception are redirected to pre-defined ROM handlers. User code can redirect any exception to a custom handler either by writing its address to the appropriate location from 4030CE24h to 4030CE3Ch or by overriding the branch (load into PC) instruction between addresses from 4030CE04h to 4030CE1Ch.
The base for the table of exception handlers on this micro is 0x4030CE24, not 0x00000000 or 0xffff0000 as indicated by the ARM manual.