Well, never heard back from the Nintendulator dev but I think we can safely cancel...
Oh, I didn't notice that page. Well yes, FCEUX does exactly what disch's notes say....
MMC1 mapper bug with bit7==1 shift register reset