I found two memory addresses which increment consistently when you "Game Over" on the overworld: 7E021C and 7E12E8. The second one seems to be the trouble.
I don't know what that memory address normally controls, but it only ever does two things:
* Reset to 0
* Increment by 3
I think it has something to do with the scripting engine. A list of things that use/reset it include: starting a battle (except on the overworld), any time a scripted sequence runs, getting a game over (see previous), returning to the title screen, and opening the menu (except on the overworld).
This variable pretty much never gets above 6 during normal play. When the Game Over scripted sequence begins to execute (kneel, change music, fade, etc) $12E8 is incremented by 3 like it is for most scripts. But if you do it repeatedly on the overworld then none of the common things which would reset it to zero ever happen. This is easy to arrange: save one step away from an encounter, at low life, and hold right+A plus emulator turbo. $12E8 will climb by 3 each death until it reaches 153 (0x99h).
When $12E8 is equal to 0x99h then the Game Over script will have some other junk appended to it. What garbage the scripting engine is fed doesn't seem to have anything to do with your lead character (in my experience). I think it has everything to do with your input:
* the timing of when you press A to acknowledge the "Annihilated..." message
* when/if you press A to cut the Game Over sequence short
By varying those two things I was able to get a number of crazy effects: a screen that said "form 4 groups" (!), a save file selection screen that looped, regaining control after the game over event (you're still softlocked), a music change, a rename screen for Locke, the final battle's "Determine Order" prompt, the snow scene from the prologue, and a bunch of parts of the credits. Again, all I did was save state with the "Annihilated..." message up and press A randomly to get different effects. This doesn't seem like a broken stack or memory corruption. (Except for when that does happen as a consequence.) All of those effects, although crazy, are consistent with the scripting engine doing those things intentionally.
So now the question is, what data is the script engine reading from, and can it be made to set a few choice event flags and return safely? The run would end real quick if it's that easy.
