I think I've identified a few more specials by looking at FireRed's default scripts. My findings:
This special updates the value of script variable 0x403A, which seems to indicate the current floor. It is used by elevator scripts.
Called when an elevator script needs to know what floor should be the default in an upcoming multichoice2. It returns 0x0, 0x1, or 0x2 (going as high as there are floors?).
Called after the player selects a floor. It appears to generate a message box depending on the player's selection (though the messagebox is immediately hidden with releaseall if the player chose the floor they are already on). Does it accept 0x8006 as the floor the player has selected?
I don't know what it does, but I do know that it is called by level scripts in the chambers for each Elite Four member. It appears to take variable 0x8004 as input -- 0x8004's value seems to denote which Elite Four chamber you're in.
Specifically, this is used to select which 3 you'll use in a (EDIT) four-player link activity (four-way battle?).
Used in the Daycare Man egg-giving script. It appears to check how many Pokemon are in the player's party (between 0 and 6), returning that number to the supplied variable.
It's not from R/S, but it is a leftover. It's called in the script for Lostelle in Berry Forest, but the buffered strings aren't used. (Perhaps in other languages, they are used?)
I don't know what it is, but it's called in the Hall of Fame registration room level scripts.
Called when talking to the woman in the Link Battle/Trade rooms -- just before she asks you to take your seat.
Called when talking to the woman in the Link Battle/Trade rooms -- just after she asks you to take your seat.
Part of Level Script 1 in ICEFALL CAVE (1.111). It appears to play a part in managing the breakable ice tiles.
Part of Pokemon-giving scripts when a Pokemon received via "givepokemon" is sent to the PC.
Apparently returns the number of the currently-selected box in the PC. It is used by scripts when the player receives a Pokemon via "givepokemon" and the Pokemon was sent to a different PC box because the currently-selected one was full.
Unknown. Used in many TRAINER TOWER scripts. Before it is invoked, 0x8004 is set to some value (I've seen 0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0xA, 0xB, 0xC, 0x10, 0x12, 0x13). It APPEARS to return a value in some cases (0x0, 0x1, or 0x2). It may also take 0x8005 and 0x8006 as input.
Used twice when stepping on the script tile that triggers the HO-OH encounter on NAVEL ROCK. Does it toggle camera movement without locking all OWs?
Sometimes used with 1BA.
Triggering a Tree wild battle isn't the only thing this function does. It will actually decide at random whether or not to trigger the battle. If no battle is triggered, 0x0000 is written to script variable 0x800D (LASTRESULT). If a battle is triggered, 0x0001 is written (so that the script calling this special knows to use waitstate).
I think it checks if var 0x8004 is the item ID of a TM, and if so, it buffers the attack that the item teaches. I think it's used upon picking up a TM (base script: 0x081A67B3).
This is used in the internal script that the game calls when the player presses A on a hidden-item Signpost event. If the item found has index 0 (item: ????????), then it is treated as a Coins pickup, and this special is used to check if the player can carry the found coins.
This is also used in PC scripts, and appears to use variable 0x8004 as an argument. 0x1B represents the PC and 0x1F represents the Hall of Fame display?
Unknown, but it's used in the Mystery Gift questionnaire script.
Called from the internal script used when the player whites out (0x081A8DFD). It sets LASTRESULT; if LASTRESULT is set to 0x1, the calling script will attempt to take money from the player.
Called from the internal script used when the player whites out. It takes money from the player and buffers the amount taken to buffer 0.
Appears to terminate a link. Called by a script at 0x081BB9D4.
Called after an endtrainerbattle2 command buried in some scripts I can't make sense of. According to the OP it sets flags above 0x500 -- trainer flags.