Does OP_HASH160 consume the top stack element? In a standard P2PKH configuration, the scripts look like: 

Pubkey script: OP_DUP OP_HASH160 &lt;PubKeyHash&gt; OP_EQUALVERIFY OP_CHECKSIG
Signature script: &lt;sig&gt; &lt;pubkey&gt; 


When redeeming P2PKH outputs, OP_DUP is done because the pubkey is used twice, once in the hash and then verifying the hashes match, and then again in verifying the signature. So, here it seems like OP_HASH160 is consuming the top stack element and replacing it with the HASH160() of what was there. 

In P2SH transactions, the scripts look like: 

Pubkey script: OP_HASH160 &lt;Hash160(redeemScript)&gt; OP_EQUAL
Signature script: &lt;sig&gt; [sig] [sig...] &lt;redeemScript&gt;


When redeeming P2SH outputs, there is no OP_DUP. Won't this mean that the redeemScript will be consumed by the OP_HASH160? How can the redeemScript be executed if it was consumed by the OP_HASH160? I think I am missing something here.
Yes, OP_HASH160 consumes the top stack element and replaces it with its hash.


  So how does P2SH work, if the script is consumed after HASH160 runs?


Here's how P2SH transactions are processed:


Execute the input script (from this transaction)
This is the transaction that only contains push-data-onto-stack commands.
AKA scriptSig
Execute the output script (from the previous transaction)
AKA scriptPubKey
Does the output script error out? If so, this transaction's invalid.
Does the output script end with a truthy value at the top of the stack? If not, this transaction's invalid.
Does this output script :


Start with OP_HASH160,
have 20 bytes of data,
and end with OP_EQUAL?  


If so, this is P2SH. (source)
If P2SH, erase the stack and run the input script again.
If P2SH, pop the top element of the stack off, and run it as a script. (source)
If that script errors out, then this transactions is invalid.