First off, you'll find a lot of helpful information at
Vexlabs, IFI's store dedicated to Vex. There's a FAQ there with some programming info. From what I understand, the master controller handles the RC communication and various other housekeeping tasks. It also has a watchdog timer to shut things down if the User processor is stuck in a loop.
As you surmise, source for the Master processor is not available. Compiled code is available if you really feel like reverse engineering it.
In the Downloads section at Vexlabs, you'll find default source code for the controller. There's an ifi_aliases.h file that aliases variables to pins on the User processor. All the pins on the controller as off the User processor, so you can use them all. There's a few CCP pins, but I didn't see any exceedingly interesting sets of pins available. I've attached the ifi_aliases.h file if you don't want to bother with the downloads.