Interesting.
What happen is that, at some time, bit #13 of INTENA is improperly set and directly cleared: [
000002BC MOVE.L #$a0002000,(A5,-$0036) <-$dff09a
].
It trigger L6 IRQ because of INTREQ EXTER bit re-set by a previous (CIA-B TOD ALRM?) pending.
The demo destroy exec, on vectors there is the old ROM jump, then system crash.
For some reason on real Amiga this strange combination works...