I often think of it almost exactly backwards from that: "What it's doing should be impossible. So what precursor that I think is impossible would have to be possible for that to fail?" I often come up with two or three possibilities. And then: "How can I find out which one it is?" This often involves re-running it with enhanced logging.

And then repeat, with the new thing that should be impossible but is still happening, until I get to the root cause.