I know Graham's method did work quite well for some games. Specifically, I think he developed this for Tailgunner (?). It's been a while since I've read that page, but I believe it is likely he is doing something a bit more sophisticated than just waiting for the interpreter to hit each instruction. A simple modification would be to continue fetching until an unrecognized instruction is hit. In this way, most of the unexecuted code paths would be covered, even if the interpreter didn't ever get there.