This is a sequence of external code executing MOVC accessing internal code memory in a completely unlocked AT89C52:

The timing is not in scale, rather, the ns on displays shall be read as number of ticks of the "logic analyzer"^* which was clocked at 24MHz (while the '52 was clocked at 12MHz).

What we see:

327"ns" - address 2018h latched by the falling edge of ALE
332"ns" - code E4h fetched at the rising edge of /PSEN
          - quick look into table - E4=CLR A
333"ns" - address 2019h latched 
338"ns" - code from this address fetched 
          - this is a dummy read, as CLR A
          is a 1-byte instruction taking 1 instruction cycles,
          and there are 2 code fetches in each instruction cycle
339"ns" - address 2019h latched
344"ns" - code 93h fetched (this time it is going to be executed)
          - 93=MOVC A,@A+DPTR (DPTR was previously set to 0)
345"ns" - address 201Ah latched
350"ns" - another dummy read, this time the MOVC is a 1-byte, but
          2 cycle instruction, so there are 4 fetches altogether;
          1 fetches the real opcode, 1 (the last) performs the
          MOVC read itself, so there are 2 dummy reads in between
351"ns" - address 201Ah latched again
356"ns" - the 2nd dummy read
357"ns" - read from internal code starts. Although ALE cycled, as
          there is a no real external bus cycle, P2 is restored
          to the state latched into the P2 SFR, which is FFh from
          the reset (there was no code executed which would write     
          explicitly into P2). P0 is floated, but it is not seen
          as it does not have pullups, so the previous state is
          retained on the parasitic capacitance of the pins/bus.
358"ns" - /PSEN was NOT asserted, indicating internal code memory
          read. Unfortunately, the value at internal code memory 
          address 0000h (which is where A+DPTR points) is 02h,
          the same value as the "floating" value of P0,
          (both being the first byte of LJMP), so we don't know
          whether this value is output onto the external bus (P0)
          or not (but I guess not).
362"ns" - the "internal /PSEN" ends, the next address is output 
          onto P0 and P2
363"ns" - address 201Ah latched
368"ns" - the "real" opcode 02h is fetched
  etc.

The same as a result of decoding the data into "human readable" form is here:

00000134: CODE 2015:90
0000013A: CODE 2016:00
00000140: CODE 2017:00
00000146: CODE 2017:(00)  MOV   DPTR,#0000h
0000014C: CODE 2018:E4
00000152: CODE 2019:(93)  CLR   A
00000158: CODE 2019:93
0000015E: CODE 201A:(02)
00000164: CODE 201A:(02)
0000016A: internal exec cycle
00000170: CODE 201A:02
00000176: CODE 201B:01
0000017C: CODE 201C:00
00000182: CODE 201C:(00)  LJMP  0100h

Note that the "decoder" has its quirks, reporting sample number in hex (so that to correlate with the "ns" in the picture one has to take a calculator), and reporting the MOVC in question as "internal exec cycle"... :-)

The corresponding code snippet which was run on the mcu is:

        
   org   0
   ljmp  2000h

   org   100h
   mov   dptr,#1234h
   movx  a,@dptr   
   mov   dptr,#5678h
   mov   a,#5ah
   movx  @dptr,a
   mov   dptr,#9abch
   clr   a
   movc  a,@a+dptr
   mov   dptr,#0
   clr   a
   movc  a,@a+dptr
   ljmp  0

   org   2000h
   nop
   mov   a,#10
   sjmp  $+2
   mul   ab
   mov   dptr,#1234h
   movx  a,@dptr   
   mov   dptr,#5678h
   mov   a,#5ah
   movx  @dptr,a
   mov   dptr,#9abch
   clr   a
   movc  a,@a+dptr
   mov   dptr,#0
   clr   a
   movc  a,@a+dptr
   ljmp  100h

   end

As you see the code example tries many possible sorts of internal/external memory combinations, and those interested can find the related raw/decoded data bundled here.

Enjoy!

JW

---
* used equipment: miniLA, the GPL logic analyzer

Picture of miniLA in action acquiring some '51 bus activity here.