OK, I cracked it!
For proof of concept, I wrote some code that makes a (broken) castle appear just south of Fabul when flag 48 is clear:


So... how does it work?
Let's preface this by saying that there's no easy equation to make this work, and the size of what you can make appear/disappear is still limited by the fairly small amount of space available for code - and this block has no large amount of empty space to speak of, so to jump to a different spot for more code would require a JML or JSL.
So...
7F:5C71-7F:9C70 is the place in RAM where the game stores the current Overworld map data. Probably Underworld and Moon, too if that's where you are, and possibly even location map data, but these are all irrelevant to what we're doing now.
Each byte in this block of RAM represents one map tile. They will all have a value of 00-7F, so if the map data in ROM says 99 05 (5 bytes of ocean), the RAM will read 19 19 19 19 19 (5 single bytes of ocean).
You may notice that this is only 4000 (hex) bytes, which at 100 (hex) bytes per row means the game is only loading 40 (hex) rows of map into the game at any given time. You'd be right. with every movement up or down, the game is constantly changing 0x0100 byte blocks of RAM. Presumably, 0x40 rows is about as far as the game can display if the map is zoomed out as much as possible, so beyond that much is deemed not worth loading.
NOW, a given spot on the map will always occupy the same exact spot in RAM, as long as it is loaded at the time, so it is possible to specify exactly which tiles you want to change, but finding exactly where in RAM your tile is can be a bit of a complicated process. So I'll do my best to explain...
So, first thing to do is fly to the correct y-position of the tile(s) you want to change:

Next, change the first byte of map RAM from 19 (it will always be 19 - there is no part of the map at x-position 0 that is not ocean) to something visually distinct, like 43 (desert):

Now, being careful to stay in the same y-position, fly out to x-position 0 to see where that bit of desert appeared:

Note that we got lucky here - you might not see the bit of desert on the first try. If you don't, skip forward exactly 0x1000 bytes of RAM (0x10 rows) and try again at 7F:6C71.
You'll have to fly left or right to get this spot out of view, then fly back after you change your byte of RAM.Once you've seen where your bit of desert appears, you can begin to triangulate the right spot. If you need to change a more north portion of the map (lower y-position), then use a lower portion or RAM, higher to move more south. In this particular situation, we need a more north position, but we're already at the very beginning of the map block or RAM, so we'll cycle to the end (7F:9c70) and move backwards from there:


Almost there... two more spaces up should do.

Found it!
This block of 0x0100 bytes is the row containing the tiles we want to change.
Next, fly back to the tiles we want to change to observe the current landscape there.
We want to change two tiles that happen to be in the middle of a row of 6 "top edge of light green grass" tiles, which, referencing
this chart, will have a value of 4C.
So we're looking for "4C 4C 4C 4C 4C 4C" in this block or RAM:

Found 'em!
Just to be sure, we'll turn these bytes into desert to be sure they're the right ones (remember to fly left and right so the game can change what the tiles look like):

OK, we're good. The Bytes of RAM we want to change are 7F:9A47-9A48.
Now, just to be sure we've triangulated the RAM bytes we want to change, let's manually make the changes. We'll turn these two bytes into 2D, 2E (top left and top right of broken castle), then we'll change the two bytes 0x0100 bytes later (7F:9B47-9B48, which will be the next row down) to 3D, 3E (bottom left and bottom right of broken castle):

Yep, that's what we want!
The next step is to find the outer limit of where this RAM will be loaded thusly... that is, how far north can I fly before these bytes are loaded with different values? I recommend slowing down emulation (press "-" on your keyboard) so as not to fly more than one tile at a time. We want to know
exactly when the RAM changes:

There we are.
Now, fly back down one space at a time until it changes back:

Once you've arrived at the right place, observe the current value of 7E:0693:

That'd be it - 3D (and 3E for the next row down).
OK, the last thing to do is figure out what your register X value will be when 7E:0693 turns to 3D. For that, use this chart:
7E:0693 X
------- -----------------------
C0 OR HIGHER (7E:0693 - C0) * 0x0100
80 THROUGH BF (7E:0693 - 80) * 0x0100
40 THROUGH 7F (7E:0693 - 40) * 0x0100
UNDER 40 7E:0693 * 0x0100So, using what we just figured out, we can write the code:
$15/C78B AD 86 12 LDA $1286 [$00:1286] A:0000 X:3D00
$15/C78E 29 01 AND #$01 A:0000 X:3D00 ;Check if flag 48 is set
$15/C790 D0 58 BNE $58 [$C7EA] A:0000 X:3D00 ;If so, skip the rest
$15/C792 A5 93 LDA $93 [$00:0693] A:0000 X:3D00
$15/C794 C9 3D CMP #$3D A:003D X:3D00 ;If clear, then check if 7E:0693 is 3D
$15/C796 D0 0C BNE $0C [$C7A4] A:003D X:3D00 ;If not, skip to next check
$15/C798 A9 2D LDA #$2D A:003D X:3D00
$15/C79A 9F 47 5D 7F STA $7F5D47,x[$7F:9A47] A:002D X:3D00 ;If so, load 2D (top left of broken castle) into 7F:9A47
$15/C79E 1A INC A A:002D X:3D00
$15/C79F 9F 48 5D 7F STA $7F5D48,x[$7F:9A48] A:002E X:3D00 ;And 2E (top right of broken castle) into 7F:9A48
$15/C7A3 6B RTL A:002E X:3D00 ;End
$15/C7A4 C9 3E CMP #$3E A:003E X:3E00 ;Check if 7E:0693 is 3E
$15/C7A6 D0 0B BNE $0B [$C7B3] A:003E X:3E00 ;If not, end
$15/C7A8 A9 3D LDA #$3D A:003E X:3E00
$15/C7AA 9F 47 5D 7F STA $7F5D47,x[$7F:9B47] A:003D X:3E00 ;If so, load 3D (bottom left of broken castle) into 7F:9B47
$15/C7AE 1A INC A A:003D X:3E00
$15/C7AF 9F 48 5D 7F STA $7F5D48,x[$7F:9B48] A:003E X:3E00 ;And 3E (bottom right of broken castle) into 7F:9B48
$15/C7B3 6B RTL ;End And there you have it!
This method can be used to make any type of tile appear anywhere on the Overworld map, using any given flag as the trigger.
It's not the quickest process in the world. It'll never make it into any editor. But at least now the knowledge is out there. One more mystery solved.