Happens merely writing $01 to $2000 repeatedly in an infinite loop with vertical mirroring. Next to nail down the timing.
EDIT: Seems that a write around pixel 255 is the cause. H/V scroll positions are irrelevant. Only occurs for two of the four CPU-PPU alignments (the two middle ones in the table I posted a while back, one of which is the "preferred" one). Hmmm, and only occurs reliably for preferred alignment (third in table).
Also, only occurs when write is at one particular dot. Not more than one. Clear now why it occurs so rarely in SMB, since you can only even hit this dot on every third scanline.
Maybe someone can probe this with Visual 2C02 now to see what's happening and exactly which dot it occurs on.