Note, this is from raw research in an attempt to document the MMU. All testing done on an fx-CG10, (What part of the serial no. matters?), OS 01.04.3200.
I have done a simple scan of the RAM to check for changes to the callbacks. I have discovered that the list of timers is stored in a stack. There isn't a fixed table of timers, so they must be allocated somehow.
Timer stack is around 0x08090038(P)(Address of the callback, may be in the middle of the structure). The size of the timer structure is 0x10 bytes. Same as on the Timers page (confirmed).
Timer 4 is set to call 0x80301FFA, frequency is 0x203A. Maybe the power-off timer?
Todo: How long is one interval?