There are some dynamic state variables that are stored in known memory locations, rather than having a dedicated register:
current catch
The pointer to the current catch block.
current unwind-protect
The pointer to the current unwind-protect block.