Attached (coming shortly, I'm testing a change to this to fix power-on condition) is a slight modification to the stock bootloader for Mega 2560s (source is at http://www.avr-developers.com/bootloaderdocs/index.html ) to make it compatible with use of the Watchdog feature in code.
The only addition to the stock source was to disable the watchdog exactly as per the datasheet - this step is key for atmega chips - then check the source of the reset, and if it was the watchdog interrupt, jump straight to the start of the loaded program (the autopilot).
You can flash this bootloader to the ArduPilot Mega board using the 6 pin ISP header which is on the red board, the top right area.
This bootloader has the !!! serial monitor section disabled (not #defined) and is therefore 2k in size, instead of 8k.
The steps to reflash it (assuming stk500v2 compatible flasher)
# erase the chip (necessary before unlocking can happen), then unlock the boot loader area
avrdude -e -c stk500v2 -p m2560 -P SERIAL_PORT -U lock:w:0x3f:m
# flash the hex file (whatever.hex)
avrdude -v -c stk500v2 -p m2560 -P SERIAL_PORT -U flash:w:whatever.hex
# re-lock the bootloader area of the chip
avrdude -c stk500v2 -p m2560 -P SERIAL_PORT -U lock:w:0x0f:m
Avrdude version 5.8 did not understand how to write high memory, so I used avrdude version 5.11. Avrdude version in the stock IDE is version 5.4
void (*app_start)(void) = 0x0000;
ch = MCUSR;
__asm__ __volatile__ ("cli");
__asm__ __volatile__ ("wdr");
MCUSR = 0;
WDTCSR |= _BV(WDCE) | _BV(WDE);
WDTCSR = 0;
__asm__ __volatile__ ("sei");
// check if WDT generated the reset, if so, go straight to app
if (ch & _BV(WDRF))
I tested and it behaves correctly. A watchdog timer can be set and if not reset, the board reboots as though the reset button was pressed.