Cool
For reference (forgive me, if I'm stating the obvious): I'm using just GND (from SIM shield) and FBUS TX pin connected to CP2102 USB to TTL converter.
I would connect GND pin of CP2102 to SIM Shiled, and RX(D) pin to a "free wire", fire up minicom (set it to 115200bps) and try to find TX pin by connecting "free wire" to one of the pins and short pressing power button on N950 that is powered off. On the right pin you should get some garbage in minicom (due to wrong speed/parity...settings), if not move on to next one until you find one that does produce something on screen when short pressing power button.

Once you do, you can try to boot kernel with console output - ubiboot args are needed to tell kernel what tty to use and at what speed, for Nemo and 4.3 kernel I'm using: On N9 I'm using simple piece of cardboard with two wires (held in place by means of clear tape) pushed into SIM slot - didn't brake anything so I guess you're safe and can't destroy N950 by doing this procedure. I still hope that some similar contraption can be made for N950 (if TX is duplicated somewhere in SIM shield bay) and testing can be done without opening the device.