The theory is that the S-CPU chip has something called a "Memory Data Register" or MDR, which stores the value for every read/write. When you attempt to read from unmapped memory, no new value is supplied for this register and so you read the same old value over and over.
Note that CPU IO cycles do not affect the MDR (and therefore the Open Bus value), even though the datasheet specifies addresses for those cycles.
Note that JSL pushes the old PB before reading the new PB, in case the new PB is being read from Open Bus. Also note that JSR (a,X) pushes the old address (low byte second) before reading the high byte of the new address.
The PPU chips also each have their own MDR, which is updated only when said PPU chip is read. When you read a register with unmapped bits, the PPU fills in only those bits that are defined and leaves the remaining bits as the MDR has them. PPU1's MDR is set by reading $2134-6 or $2138-A, and may also be read from the write-only registers $21x4-6 and $21x8-A (x=0-2). PPU2 involves registers $213B-D only (and maybe $21xB-D, but this is unverified).
By Anomie (anomie@users.sourceforge.net)