From an end-user perspective, the bug happens when:

• Original is in a web-safe format (i.e. JPEG or PNG, which is most images).
• Original is around 3000px large, or smaller.

Technically:

• When $wgMediaViewerUseThumbnailGuessing is enabled for performance reasons to save API calls (true in WMF production).
• And $wgTrackMediaRequestProvenance is enabled (true on most prod wikis, per T414338).
• And the embedded image is a thumbnail (i.e. a 250px thumbnail was generated, the original is not smaller than 250px)
• And the MediaViewer preview is requested for a size larger than the original (e.g. preview is 2000px but original is 1800px)

In this case mmv.GuessedThumbnailInfo.js will derive the original from the thumbnail URL, and in doing so loses the provenance parameters. Even if it preserved them, however, these would invalidate a signed hash. But that's true for all guessed thumbnail URLs, including when using the core mw.util mechanism between two standard sizes (vs standard to original, or standard to non-standard). So that's an issue we'll need to deal with another time, if at all.