Loadblock an old chain with P2SH violating blocks in it. These blocks are not rejected because they are below the highest checkpoint and the scripts aren't tested. Substituent blocks reorg them out and the transactions are not tested before being inserted in the mempool.
(just opening an issue so this isn't forgotten, see bitcoin-dev logs from 2012-11-28)