I am not sure that the current running order is actually stored ANYWHERE.

If it's a premade playlist that's running, well.. the FID for the playlist is stored in the flash savearea, along with the FID of the currently playing track.

If it's a randomly convoluted playlist, then they probably just do the randomization on the fly, with known randomizer seed (maybe also stored in the flash savearea?). They could step forward/back through the "playlist" by just (re)generating the pseudorandom sequence on the fly.

???