I have a sense that it's an impossible question but I ask nevertheless, because sometimes people here have answers to impossible questions

As I see it:
- I do not quite know what power-on open bus looks like, but if the 2A03 reset is short enough, then I think the databus will get all 0s, but over time the bits will flip to 1s, and not simultaneously, which will complicate tremendously the study;
- let's suppose PC points to an area that is open bus and the databus is $FF, then it executes ISC $FFFF,X. I'm not sure of the operation of unofficial instructions, but I guess it ends on a write. With X = 0, it will fetch $FF and then final write is 0. This write will set the databus and if the next PC is still open bus the next opcode will be BRK. The last push on the stack is the status register; thus the next PC will depend upon the value of the pushed status register. If the address is still open bus, then there is an high chance that the same value (status register) will be interpreted as an opcode.
- Executing code in uninitialised RAM is unpredictable, but it would be next to impossible to encounter any JMP/branch instruction that jump back into an already executed instruction, and thus create a code loop.