you can use pins not used by the shield. the attachment pins of shield don't define the used and free pins
for example the Ethernet shield uses SPI pins on the ICSP header but those are the same pins as 50, 51 and 52 so this pins can only be used as SPI in this case. and the Ethernet shield uses pin 10 as Slave Select for networking chip and pin 4 as Slave Select for SD card if you insert one. this are the only pins taken on Mega by the Ethernet shield in the part where it is attached