You're right: many of TecToy's Brazil-exclusive Master System games were tweaked versions of Game Gear releases. That includes games like Ecco 2, Mortal Kombat 3 and Sonic Blast, but not the aforementioned Street Fighter II which they developed independently.
I think the Master System version of Sonic Spinball came from Sega themselves though. It was sold in Europe as well as Brazil.
I don't know if they even had an emulator at the time - I don't think a 1980s PC could run a NES emulator at a reasonable speed.
Another possibility is that they used a hardware device. Perhaps something that watches the 6502 `sync` pin to know when an opcode byte is being read, and verifies that the data bus contains a legal value.
> On execution, 16-bit Thumb instructions are transparently decompressed to full 32-bit ARM instructions in real time, without performance loss.
That quote is from the ARM7TDMI manual - the CPU used in the Game Boy Advance, for example. I believe later processors contained entirely separate ARM and Thumb decoders.
Throughout the entire NES game library, almost no games use these illegal opcodes. Apparently as part of the licensing process, Nintendo would verify that games only used the official instructions.
I wonder how they tested that, though? I don't think developers had to submit their source code to Nintendo, so they would have had to analyse the binaries in some way?
I think the Master System version of Sonic Spinball came from Sega themselves though. It was sold in Europe as well as Brazil.