OBVIOUSLY KNOWS WHAT HE'S TALKING ABOUT GUYS SO THE DS HACK IS FAKE OKAY LETS JUST GO HOME
Let's put it simply.
Insert cartridge into 3DS.
3DS boots the ROM off of the cartridge.
3DS loads save data from save flash into memory.
You play your game.
The cartridge does not boot itself. I do not have a stack of free-energy powered 3DS cartridges sitting on my desk running 24/7 because they're booting themselves.
So say you have a savegame exploit. The save flash is rewritable, or else you would not be able to save your game. So you make a hacked game save, encrypt it, and use something like the R4i Save Dongle or NDS Adapter+ to write it back to the cartridges save flash. Then...
Insert cartridge into 3DS.
3DS boots the ROM off of the cartridge.
3DS loads save data from save flash into memory.
You play your game.
And with the hacked save:
You play to certain point where the modified part of the save data is accessed.
Stack overflow, crash system
Load custom code
Get some sort of higher level access and execute unsigned code. Hopefully.
Your SD card is not a part of the equation. Period. If you don't believe me, go load up any cartridge based 3DS game and remove your SD card before it loads, your save game will still be there. Or go ahead and take it out while you're playing then save your game. Your game will still save.
You're incredibly dense.
ANYWAY
I'll have to keep an eye on what happens with this. Would certainly be easy to do as a cart based exploit, my 3DS is a few SM revisions back, as is my brother's. If it turns out I can't update it or else I lose the hack, then so be it, I'll buy an XL in addition. I do need to update it and redownload all of my Ambassador games though.
Edit - if re-writing and loading modified saves weren't possible, people wouldn't be able to use Pokesav to get Pokemon with custom stats in their legitimate cartridge based games. But they do, somehow.
http://cyclods.wikidot.com/homebrew:pokesav