Really obscure bug time:
This is something I've known for quite some time, but have only recently understood some of the implications of it.
At address 8000 0000, there is a short routine that is used to jump to an exception handler. I don't know if the exception handler is ever called, but from what was explained to me it is jumped to whenever a bad 32 bit address is hit, and that potentially this could be hit if an issue came up when rendering graphics.
Now, when spawning into pre-rendered scenes, the game will sometimes? overwrite the data at 8000 0000 in at least NTSC 1.0 and NTSC 1.2, ruining the code that jumps to the game's exception handler. However, from some limited testing on Master Quest PAL, I've noticed that this address doesn't seem to be written to anymore.
This has got me wondering, because potentially there could be a non-fatal exception thrown that forces the game to execute code at 8000 0000, but crash due to the corrupt code.