I don't know if this is generally known or if nobody ever checked that out, but I found some new test pads on the Raspberry Pi Zero W that were not documented (or at least, I didn't found any comment on it).
In the attachment, you'll find the position and the names I gave them.
PP6 and PP7 are probably from the BCM0-BCM27 range, but I didn't check for them yet.
I tested this by charging a bare metal program that did nothing (empty while loop) and using the gpio command in the config.txt file to pull the GPIOs high or low.
That's cool, because those pins correspond to a complete SPI port! (SPI0) (check for their function: https://elinux.org/RPi_BCM2835_GPIOs#GPIO36)
Hope that helps anybody who is searching for more pins!