What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?
I don't consider the following a complete answer, but it is a start, and best I can do with  my very limited knowledge. I hope someone could fix it or improve it.

These type of attacks are only possible against specific implementation of higher level protocols. 
I will start by describing an invalid-curve attack against a specific ECDH based protocol.



Simple Pairing protocol:
Entity A wants to establish an encrypted and authenticated channel with Entity B, and both support the same pairing protocol, based on ECDH using P-224


Entity A sends its own ECC public key ($pub_A$) to B
Entity B sends its own ECC public key ($pub_B$) to A
Both devices computes ECDH, thus generating a shared point ($SP = priv_A*pub_B = priv_B*pub_A$)
Individually they run this shared point through a KDF, generating $K_{ENC}$ and $K_{MAC}$
Entity A starts communicating to B using AES CTR to encrypt the communication and AES CMAC to authenticate the ciphertext.


Let's now suppose B is malicious and wants to recover A's private key.

Conditions for the attack to succeed: 


A doesnt't check if the B's public key, or computed shared point, actually lie on P-224.
Public keys are exchanged with both $x$ and $y$ coordinates and both are used in the scalar multiplication algorithm.
The scalar multiplication algorihtm doesn't use the value of $b$ in the computation (this is very common for short Weierstrass curves)


B generates elliptic curves $EC'$ over the same field $F_p$ of P-224 with the same $a$ parameter but different value for the $b$ parameter. B computes the order of those curves, and factor it, looking for small primes divisors. 
Let's suppose he finds a suitable curve with order of form $17*h$ where $h$ is a composite not divisible by $17$. This means that there is a subgroup of $EC'$ with order $17$.
B finds a point of this small subgroup, calls it $pub_B$ (his public key) and sends it to A.

A will compute $SP = priv_A*pub_B$, derive $K_{ENC}$ and $K_{MAC}$ and starts the secured communication.
Note that A will in fact compute the scalar multiplication over $EC'$ and therefore $SP$ has only $17$ possible values.
In this way he finds the value of $priv_A\mod17$

He repeats the attack with other small groups having order coprime to each other (he can use several $EC'$), and then uses the $CRT$ to recover $priv_A$.



Let's now discuss the case where the scalar multiplication doesn't use the $y$ coordinate.
Premise: Hereafter I will assume that a x-coordinate only ladder can be used on the original curve and on the twist. The answer to this question explains how a twist curve can be used for short Weierstrass curves. 

Now the job of B is much more complicated because he can't easily provide to A a public key on a generic $EC'$ since the $y$ coordinate is key for this, as without the $y$ A will compute the scalar multiplication on $EC$ and not on $EC'$. But, since A algorithm will work for the twist also (as in our premise) then B can use a non trivial quadratic twist of $EC$.

There is one set of isomorphic curves, each curve within the set is defined through a $c$ that is not a quadratic residue in $F_P$, by $y^2 = x^3 + c^2ax + c^3b$. 
$a$ and $b$ are the original curve's parameter, and this set is the $twist$.
These curves have order different from the order of $EC$, namely $p+1+t$ where $t$ is the trace of $EC$. If the order factors in many (relative) small primes then it opens the door to an invalid curve attack, where B sends public keys lying on small subgroups of the twist.

For P-224 the order of the twist factors to:
$$3^2 * 11 * 47 * 3015283 * 40375823 * 267983539294927 *
177594041488131583478651368420021457$$
So he can use the small subgroups of orders $3,11,47,3015283,40375823,267983539294927$.
He needs to bruteforce on $K_{MAC}$ for each subgroup so this attack requires about $2^{log(267983539294927)} = 2^{47.93}$ operations to get by CRT the value of: $$priv_A \mod(3 * 11 * 47 * 3015283 * 40375823 * 267983539294927) $$
Now B can computes the actual value of $priv_A$ by Pollard's kangaroo. He uses the information he just got, limiting the search to $n/(3 * 11 * 47 * 3015283 * 40375823 * 267983539294927)$ which is about $2^{105.32}$. Due to Pollard's kangaroo complexity it requires about $2^{105.32/2}=2^{59.34}$ operations, which dominates the complexity analysis.

Note this number is close but not equal to Dr. Bernstein's number of $2^{58.4}$ operations.
In this page he shows that he calculates the complexity of the combined attack as $log(\pi/4*l)/log(4)$ where $l$ is the largest prime in the divisors of the order (that is exacly our $n/(3*11*47*3015283*40375823*267983539294927)$, which approximate to the $2^{58.4}$ value of the question. I don't know where his formula come from, most likely from a much better knowledge of Pollard's Kangaroo running time.

Edit1: understood calculation from bernestein, modified the premise since my question was answered.