I don't know if they even had an emulator at the time - I don't think a 1980s PC could run a NES emulator at a reasonable speed.
Another possibility is that they used a hardware device. Perhaps something that watches the 6502 `sync` pin to know when an opcode byte is being read, and verifies that the data bus contains a legal value.
The QA process might have been performed on an emulator that doesn't support illegal opcodes.