Could I just substitute any with the same package, clock speed, and capacitance?
That should work fine. That's what I did, except I goofed and got the full-height (49/U, I think?) package. The crystal works just fine, but it stands out
because it's so tall.
It's not the correct way to do things but I find that, for most of my tinkering applications, if I root around in the junk box and find a crystal with the right frequency it works. I don't worry about parallel vs. series and the capacitance, if it means I can get away without placing an order to get the "right" one.