You can get the folder by running (replace with your bundle id at the end):
# This will print the application bundle's folder
xcrun simctl get_app_container booted de.company.app
# This will print the data folder
xcrun simctl get_app_container booted de.company.app data
If you use this often, you can set up an alias like so:
alias cdph='cd $(xcrun simctl get_app_container booted de.company.app data)'