Version: 4.99.3
OS: Windows XP 32-bit SP3 (joined to a domain)

I believe I've observed the same behavior on Pulseaudio 3.0 and 4.0 too.
I also believe I've observed the same behavior on other versions of Windows (such as Win7 64-bit Pro SP1.)

XDG_CONFIG_HOME appears to default to the path %USERPROFILE%\.config . So if I do not set XDG_CONFIG_HOME, the cookie is created at:
C:\Documents and Settings\mike.DEPAULO\.config\pulse

If I set XDG_CONFIG_HOME to C:\test\config, pulseaudio will use an existing cookie at either:
C:\Documents and Settings\mike.DEPAULO\.config\pulse\cookie
C:\test\config\pulse\cookie

However, the problem is that the cookie is not created at either path. 

Furthermore, if the cookie cannot be found, pulseaudio.exe fails to start. It produces the following output, then quits:

C:\Program Files\x2goclient\pulseaudio-4.99.3-win32-bug_66962-bug_69712-test>pulseaudio.exe -n -F C:\config.pa
W: [(null)] pulsecore/core-util.c: Secure directory creation not supported on Win32.
W: [(null)] pulsecore/core-util.c: Secure directory creation not supported on Win32.
W: [(null)] pulsecore/core-util.c: Secure directory creation not supported on Win32.
W: [(null)] pulsecore/core.c: failed to allocate shared memory pool. Falling back to a normal memory pool.
W: [(null)] pulsecore/authkey.c: Failed to open cookie file 'C:\Documents and Settings\mike.DEPAULO\.config/pulse/cookie': No such file or directory
W: [(null)] pulsecore/authkey.c: Failed to load authorization key 'C:\Documents and Settings\mike.DEPAULO\.config/pulse/cookie': No error
W: [(null)] pulsecore/authkey.c: Failed to open cookie file 'C:\Documents and Settings\mike.DEPAULO\.pulse-cookie': No such file or directory
W: [(null)] pulsecore/authkey.c: Failed to load authorization key 'C:\Documents and Settings\mike.DEPAULO\.pulse-cookie': No error
W: [(null)] pulsecore/core-util.c: Secure directory creation not supported on Win32.
W: [(null)] pulsecore/authkey.c: Failed to open cookie file 'C:\Documents and Settings\mike.DEPAULO\.config/pulse/cookie': No such file or directory
W: [(null)] pulsecore/authkey.c: Failed to load authorization key 'C:\Documents and Settings\mike.DEPAULO\.config/pulse/cookie': No error
E: [(null)] pulsecore/module.c: Failed to load module "module-native-protocol-tcp" (argument: "port=4713"): initialization failed.
E: [(null)] daemon/main.c: Module load failed.
E: [(null)] daemon/main.c: Failed to initialize daemon.
W: [(null)] pulsecore/core-util.c: Secure directory creation not supported on Win32.

Note that my config.pa file contains the lines:
load-module module-native-protocol-tcp port=4713
load-module module-esound-protocol-tcp port=4714
load-module module-waveout

Note that this bug appears to be separate from Bug 75006 - "neither XDG_CONFIG_HOME or PULSE_COOKIE is respected" because:
1. An existing cookie can be used relative to XDG_CONFIG_HOME.
2. When XDG_CONFIG_HOME is set, whether the cookie is found or not, the runtime dir is still created relative to XDG_CONFIG_HOME.