While building a filesystem explorer I discovered several mechanisms left for developers, which let you get into the PlayBook simulator. The most obvious and useful one is a simple telnet interface, to which you merely need to know the userid and password (but these were pretty obvious). [This feature was replaced with an SSH interface in more recent versions. -Ed]
Over the next few days I'll be posting details about some interesting discoveries I've made, not the least of which is that the unit will have Python 2.7 inside!
Edit: after re-reading the BlackBerry Table OS SDK License Agreement, I think I'd be wise to take into account section "12. Confidentiality". I'll limit myself to things that are fairly far from being considered potential trade secrets or RIM-confidential information. That means I'll just go hide my draft article that describes the filesystem layout...