I just verified that the HttpSessionListener's sessionDestroyed method is invoked even in the case where a session is invalidated through expiration. Which version of GlassFish are you using?
[Message sent by forum member 'jluehe' (jluehe)]
http://forums.java.net/jive/thread.jspa?messageID=267797