It's hard to point at any single byte without having a ZX programming reference or the ROM contents handy, but I may give you some ideas:
- choose a function that you aren't going to use (say, saving to the tape), use its entry point as the address
- find where the the font is stored, choose a byte in one of the characters. Most likely everything will still work, but you'll get that line in the character drawn incorrectly
- choose the location where execution starts when you power it up, but wait out with enabling your circuitry until after the first instruction has executed
- literally look for unused sections, those are probably going to look like fairly large contiguous runs of 0xFF bytes (wait, I've found the ROM in an emulator, there is such a region, from 0x386E to 0x3CFF, but I don't know if this ROM is original or altered, you'll need to examine yours)