My thoughts, based on experience, is that they can pop at any time i.e. the burn time/failure distribution is very wide. The vehicle was about a year old when the first one was replaced and I still have one original left after 5+ years. Even if we did have a measure of burn time I don't think it would be much help.
The ceramic usually splits and yes there is a risk of GP fragments breaking off in the cylinder and causing significant damage but there is also reports of missing ceramic and no apparent damage. On the other hand, there are also numerous reports of GP's shearing during removal resulting in an expensive extraction exercise.
The whole thing is a bit of a crap shoot. My money is on replacing ceramic with ceramic when, and only when, they fail. I have 2 spares left and once these have gone I'll replace them all with the metal upgrades. This, of course, assumes that one of the other terminal failure modes don't take it out first
