The attched patch (debug_mwe_001.diff) is a minimal working example that demonstrates the issue on all three platforms (X11, W32, NS) using the GUI version of Emacs built from the master branch as of 04/08/2019 (a038df77de7b1aa2d73a6478493b8838b59e4982).

The snippet that I am pasting and evaluating in the minibuffer is as follows:

(progn
  (find-library "simple")
  (fundamental-mode)
  (blink-cursor-mode -1)
  (global-eldoc-mode -1)
  (setq timer-list nil
        timer-idle-list nil
        crosshairs t))

Here are Youtube links to screen recordings of the minimal working example on all three platforms:

NS (screen recording):  https://youtu.be/4IzXfP2j2GY

X11 (screen recording):  https://youtu.be/zrRH72qdmx0

W32 (screen recording):  https://youtu.be/cfIG4fbkesY

MINIMAL WORKING EXAMPLE:

1.  Imaginary / Pretend:  We imagine that all fake cursors are erased at the outset of update_window while w->current_matrix is still valid; i.e., before scrolling_window does its thing.

2.  The master cache of fake cursors (w->ch_cache) is set to Qnil.

3.  Imaginary / Pretend:  We imagine .... As to the rows in the w->desired_matrix that must be updated with update_text_area, we draw fake cursors immediately after draw_glyphs finishes updating the row.  As we are laying fake cursors, we use a temporary cache (w->mc_temp_cache) to store the relevant data so that we can redraw any fake cursors that get erased because they are left/right_overwritten as determined by draw_glyphs.  Once the row has been updated with fake cursors, we set the termporary cache (w->mc_temp_cache) to Qnil and we set the master cache with the new data -- appending new data if the cache is non-nil.

4.  As to all remaining rows that are not updated with update_text_area (which uses w->desired_matrix), we use the w->current_matrix and draw/cache the fake cursors using the same approach as mentioned in the preceding step; i.e., a temporary cache (w->mc_temp_cache) so that we can fix any fake cursors that got left/right_overwritten and then that cache is set to Qnil and the master cache (w->mc_cache) is updated.

In the above minimal working example, the window Lisp_Object caches are rather simple:

'((make_fixnum (1))
  (make_fixnum (2))
  (make_fixnum (3))
  ...
  (make_fixnum (99)))