The problem happens when I run VirtualBox full-screen, with a "mini toolbar" enabled.  Normally, the toolbar is mostly hidden, except for a few pixels that stand out against a black background.  When I hover the mouse over those few pixels, the toolbar is supposed to slide out, and give me options like minimizing or killing the virtual machine.

With newer versions of xfmw4, however, the toolbar does not slide out, and instead, my Xfce panel at the top of the screen (which is normally hidden) starts flickering.

I recorded a video: https://www.youtube.com/watch?v=BAGZw4QRefc

(At the end of the video, I got the mini-toolbar to appear by right-clicking the handle.  So, that's one workaround.)

If you're using VirtualBox and wondering how to enable the mini toolbar, open a VM's settings dialog and navigate to the "User Interface" tab on the left.  I think it's enabled by default, though.

I'm using Ubuntu 16.04.  The problem reproduces with 4.12 and master, but not 4.10.  To compile xfwm4-4.10, I had to comment out a call to xfce_shortcut_conflict_dialog, because the API had changed.

I bisected the issue, which identified this commit:

1a20a884e5cd33255e822f42a73bbe83ff89aea1 is the first bad commit
commit 1a20a884e5cd33255e822f42a73bbe83ff89aea1
Author: Olivier Fourdan <fourdan@xfce.org>
Date:   Wed Dec 10 22:21:19 2014 +0100

    Use source indication in activate window

    Bug: 10747

    xfce4-panel was not setting the source indication
    for NET_ACTIVE_WINDOW messages so we could not use it.

    Bug 10508 got that fiex in xfce4-panel so we can (and must)
    use the source indication.

    Note, this will break with earlier (broken) xfce4-panel
    versions.

    Signed-off-by: Olivier Fourdan <fourdan@xfce.org>

FWIW, my current workaround is to use a patched version of Ubuntu's xfwm4, which I hacked:

diff --git a/src/events.c b/src/events.c
index 50303b0..9d97ac5 100644
--- a/src/events.c
+++ b/src/events.c
@@ -1402,7 +1402,8 @@ handleEnterNotify (DisplayInfo *display_info, XCrossingEvent * ev)
         screen_info = c->screen_info;
 
         TRACE ("EnterNotify window is \"%s\"", c->name);
-        if (!(screen_info->params->click_to_focus) && clientAcceptFocus (c))
+        if (!(screen_info->params->click_to_focus) && clientAcceptFocus (c)
+            && strcmp(c->name, "VirtualBox") != 0)
         {
             if (!(c->type & (WINDOW_DOCK | WINDOW_DESKTOP)))
             {