I'm doing something similar to what you describe by running an action on the node-leave event that changes the "to" node of the transition that will be used to point to whatever arbitrary node I need to send the token to. Then when the token reaches the destination node, the "to" of the transition is changed back to what it should be, then the whole transaction is committed if successful.
I don't know if you could actually add a transition on the fly instead of just changing an existing transition, though. I think I looked into this and decided to do things the way I described so I wouldn't have to tweak jbpm code to make it work.
I'm sure that this kind of changing of the process def at execution time is not recommended, but it works for my purposes (at least no problems so far) and sounds like it might be similar to what you're after.
Why not define your transition name with prefixes for example and then tweak the web interface in a way that it does not display the transition with this prefix. Example, you can name the transition as "sys_cancel", and in your web interface, don't display transitions that start with "sys_".