The emulator I was mostly using for development (DOSBox) doesn't actually crash itself, but here's a nice example of how it goes wrong. In the final part of 8088MPH there is an instruction that modifies the instruction after it, but then (on the real hardware) the old version of the instruction is executed (because it's already in the CPU's prefetch queue when the modification is made). DOSBox executes the modified instruction because it doesn't simulate the prefetch queue. I tried moving the to-be-patched instruction above the patching instruction but that made the code take longer to execute and it no longer met the precise timing requirements necessary for the best audio quality.
Modifying code in the prefetch queue was a well-known anti-debugging/emulation trick in the pre-Pentium days but this is probably the first time I've heard it being used as an optimisation - seriously amazing work.
