Yes, PUSH SP is still open.
One idea I thought of but now consider unimportant was trying to determine the exact sequence of addresses for various instructions' dummy fetches. This, however, would not only be probably very difficult to examine but of practically no utility, since it's the number and timing of dummy fetches that matters for the few 8051 applications that depend on it (most spectacularly Intel's SDK-51, which has an elaborate circuit that counts 8031 instruction cycles to work around the lack of cycle-synchronizing inputs and outputs).
For interrupt and timer testing, it should be possible to set the INT0/INT1/T0/T1/T2/T2EX pins from the port registers and have the peripherals respond to that, given that they're quasi-bidirectional. The serial receiver could be tested similarly in Modes 1 and 3, but Modes 0 and 2 run uncontrollably fast and might only be amenable to cruder tests. (Mode 0 has the best-defined timings anyway.)
Last edited by AJR; 07/17/19 12:21 PM.