It's actually horribly hacky (and I didn't realize this until I read the code).

The redeemscript is actually a blob of data which is pushed to the stack first. Once the script (input and output script, no redeemscript) is interpreted once, the verifier checks if the scriptPubKey was a P2SH script (of the form OP_HASH160 OP_EQUAL). If it is, it pops the first item from the stack (which will be the redeemscript) and interprets that as a script and runs it. So the input script only consists of pushes since the redeemscript is really just a push of X bytes and is only later actually treated as a script.