The unassigned SFR addresses frequently contain various test and control registers. For example, the IAP routines in a flash part need a way to control and write to the flash. The easiest way to do this is to add a hidden SFR to accomplish the task. These registers may or may not be accessible to the end user. In the Tekmos 8051s, we use 4 registers just to control the flash. (D[0:7], A[0:7], A[8:15], and A[16:23])

Since these are undocumented, very bad things can happen if you try to use them. For example, you might trigger a flash erase.

Furthermore, there is no guarantee that a hidden register in one part will still be in the part in the next batch of parts that you buy. Suppose that you use a hidden Flash control register for one byte of storage. In our case, the registers are closely linked to the design of the Flash. If we changed Flash vendors, we would likely have to change our Flash interface circuit. And if we didn't need the register in the new design, we would remove it. And that would cause your code to break.

As a hobby, you can run all of the SFR experiments that you would like. But a professional should never use undocumented features. If you need a few more bytes, use an 8051 with more RAM.