I failed to distill a small testcase like

int *q;
int main()
{
  int *p = q;
  int a = 1;
  try {
    a = *p;
  } catch (...) {
    int b = *p;
    a += b;
  }
  __builtin_exit (a);
}

where a __cxa_begin_catch (_1); prevents CSE of the *p load across the EH
edge with -fnon-call-exceptions:

  <bb 2> :
  # VUSE <.MEM_4(D)>
  p_5 = q;
  # VUSE <.MEM_4(D)>
  _7 = *p_5;

  <bb 5> :
<L3>:
  # VUSE <.MEM_4(D)>
  _1 = __builtin_eh_pointer (1);
  # .MEM_9 = VDEF <.MEM_4(D)>
  __cxa_begin_catch (_1);
  # VUSE <.MEM_9>
  _10 = *p_5;

but for g++.dg/opt/pr92610.C and g++.dg/pr48633.C with for example -std=gnu++14
we can see it doing this:

  <bb 6> :
  _45 = MEM[(sizetype *)_28];

   <bb 18> :
 <L18>:
-  _51 = MEM[(sizetype *)_28];
-  _15 = _51 + 2;
+  _15 = _45 + 2;
   _16 = _15 * 4;
   operator delete [] (_28, _16);
   resx 5

thereby ICEing with a new SSA verification piece I coded after directing
Martin to only consider the fallthru edge as insert location for the SSA
defs of an internally throwing stmt.

DOM is probably susceptible to this, too.

I'm not sure how to trigger a real-world case that would exhibit breakage
(for the above we're removing another trap on the EH handler side).  A way
to trigger the odd IL seen for pr92610.C in a more controlled example
would be nice to have.