My Submission of Super Mario Bros "Stop 'n' Swop Arbitrary Code Execution" ( https://tasvideos.org/8197S ) unfortunately requires an unofficial release of the Bizhawk emulator. In order to verify this on console, I have split up the two halves of the TAS into the SMB3 section and the SMB1 section.
This is the section for SMB3, tested on Bizhawk 2.8 in the SubNesHawk core.
The TAS uses subframe inputs to write a custom loop that takes in inputs and stores them at any target address. This lets me write anything to any location in RAM. I use it to write a 22 byte payload at address $181 that will be executed after swapping out SMB3, and running the SMB1 TAS that can be found here: https://tasvideos.org/UserFiles/Info/638160458975160308