My assumption was right, the Philips bootloader never initialize the stackpointer and expect the reset state.

Because my routine call the bootloader, SP must be loaded with 5, so the bootloader was entered with SP = 7.

Following the complete code:

#define CALL(addr)      (((void(*)(void))(char code *)addr)())


void emergency_exit(void)
{
  unsigned char i;

  for( i = 1; i; ){             // 8 consecutive zeros = run Philips bootloader
    i += i;
    if( P3_7 && P3_6 )
      i++;
    if( i == 0xFF )             // 8 consecutive ones = run user bootloader
      return;
  }

  EA = 0;

  SP = 7 - 2;                   // Stackpointer = reset value !!!

  AUXR1 |= AUXR1_ENBOOT;        // enable boot
  CALL( 0xFC00 );               // invoke Philips bootloader
}

Peter