I thought I would post this in case anyone else, like me, has wasted a day on a this problem and hasn't found a possible cause/solution.
There is an issue on the 9S08SH16 parts, but I don't know if this is related to a batch only. If you poll the TPM1 Channel 1 interrupt flag (TPM1C1SC_CH1F) for a number of cycles, the MCU will suddenly start to change its system frequency and will jump to a random memory address location.
I have tested this by polling Channel 0 on TPM1 and the TPM2 channels and the device is stable when doing so. I also tested this on all of the parts I have (13 in total) on our prototypes and they all behave the same. I have also sent this to Freescale support for them to look into.
I hope this may help someone else out there who has been pulling their hair out wondering what's going on.