The firing of processing-time timers is off by one. This leads to problems in edge cases, as discovered here (mailing list) when elements arrive at the timestamp that is the end of the window.
The problem is here (github). For event-time, we fire timers when the watermark is >= the timestamp, this is correct because a watermark T says that we will not see elements with a timestamp smaller or equal to T. For processing time, a time of T does not say that we won't see an element with timestamp T, which makes processing-time timers fire one ms too early.
I think we can fix it by turning that <= into a <.