Real world example of non-interactive zero knowledge proofs?
The argument about Peggy being able to start over is not about NI-ZK proofs, it is about zero knowledge in general.

Zero knowledge does not give you a definite certainty that Peggy actally has the claimed knowledge. In your example, the probability of Peggy being able to cheat is $1/2$ after one round. If we do this for two rounds, the probability that she cheated twice succssfully is $1/4$. This goes on, until there is a satisfying probability, e.g. that Peggy could only cheat with probability of $1/2^{80}$ for 80 rounds.

Now, if we require in a NI-ZK proof that Peggy created a transcript with 80 rounds, she would have to start over for $2^{80}$ times to find such a transcript, if she doesn't have the ability to go back just one round. This has to be enforced, which is done in the Fiat Shamir heuristic by hashing all the previous results. In the CRS model this is achieved by defining the reference string only with a certain distribution and granting no one authority over this choice. This assumption implies, that Peggy can not just go back one step. If she starts over from the beginning, the entire string would change. 

From a practical point of view, this is a challenge. The most commonly suggested practical solution would be a trusted third part, like for certificate authorities. But the effort of creating and publishing common reference strings is quite a lot more complex than building a PKI.

For some interesting arguments about this, and a possibly different realization I would suggest reading Cryptography in the Multi-string Model by Groth and Ostrovsky. Especially the introduction is quite interesting and their proposed new setup assumption.

Considering most usages of a CRS in the sense of NI-ZK is that there is usually some property, which is then used in order to prove the ZK property. In regular ZK you give the simulator some kind of advantage, e.g. being able to rewind one step. In this model you use some kind of commitments, which are binding in the real protocol but the advantage of the simulator is that he can decomit his previous commitsments to anything.