There's nothing in the Reference Manual or Errata mentioning FB_A16.
However, given that these manuals are all made up by pasting together edited versions of previous manual chapters, sometimes it is worth doing some "genetic archaeology".
So I'm searching for all other Coldfire chips that reference "FB_A16" (or FB_A<anything>) in their Reference Manuals. Most chips override the Data lines on reset. Very few seem to override the Address lines. The search turns up...
Check the Reference Manual for the MCF52277 (MCF52277RM.pdf):
9.4.1.2 Reset Configuration (BOOTMOD[1:0] = 10)Pin(s) Affected Affected CCM Override Pins Function Register Bit(s) in Reset----------------------------------------------------------(none) RCON[1] FB_A16 Oscillator Mode 0 Crystal oscillator mode 1 Oscillator bypass mode
FB_A18 is documented as the pin controlling the Oscillator Mode on the MCF5301X, but maybe there's a "leakage" from FB_A16.
The manual says to "pull up the other address lines or leave them floating" and maybe the development boards did that.
> it's not a simple fix for us (Unless we bodge it by using pull-up/down resistors and don't actively drive the lines) 
You'll have read the Reference Manuals where they always give big warnings to "actively drive the lines during reset" and not not use pullups or pulldowns. That warning shows up in all the manuals:
MCF53017RM.pdfNOTEThe logic levels for reset configuration on FB_A[21:17] must be actively driven when BOOTMOD is 10 or 11.MCF52277RM.pdfNOTEThe logic levels for reset configuration on FB_A[21:16] must be actively driven when BOOTMOD equals 10.MCF5208RM.pdfNOTEIt is recommended that the logic levels for reset configuration on D[9,7:1] be actively driven when RCON is used.MCF5329RM.pdfNOTEIt is recommended that the logic levels for reset configuration on D[9:86:1] be actively driven when RCON is used.
Notice a pattern? You might be surprised to know that I have only ever found ONE Freescale Reference Design Board (the MCF5329 Validation Board) that obeys those recommendations. All the rest i've seenl use pullups and pulldowns on the address or data lines! So bodge away, that's what they do on the Reference Designs!
> I do not have access to a Freescale dev board otherwise I would try my findings on that.
So hunt for the Development Boards and see if you can find the schematics. Like these ones:
http://www.freescale.com/webapp/sps/site/prod_summary.jsp?code=M53017MOD&fsrch=1&sr=1
http://cache.freescale.com/files/32bit/hardware_tools/schematics/M53017MODSCH.pdf?fpsp=1
That board pulls A17-A21, but seems to leave the others floating. Of course it uses resistors and not "active drivers".
You don't expect Development boards to be reliable, do you? There's often a lot of things different with them, like heavily loaded busses or bus beffers so they can be used with everything. i had a serious crystal/bus/startup problem with the MCF5329 that could be fixed by a very slow startup power supply ramp. Like the one you get with a plug-pack powering the development board. So the Devel board wouldn't show the problem until I started unplugging the power cable at the board. Then it failed to boot sometimes, and it was that proof that got this problem into the Errata.
This isn't your problem, but with regards to FB_A22, check that you're driving FB_A21 to an appropriate level during reset.
FB_A21 determines RCON[5] AKA CSC. If high, then FB_A[23:22] are FB_A[23:22] after reset, otherwise they're FB_CS[3:2].
Are you expecting them to be Address or Chip Select lines? Are they being used in any address decode, or are they feeding a ROM chip?
Keep us informed, especially if you get a sensible answer from Support. If you get an hilarious nonsense response, then post that too 
Tom