I've confirmed that this behaviour was introduced by the ICEfaces code.
They had some custom logic to determine if a session times out via their
asynchronous bridge, and it was not taking negative values into
consideration.
I've fixed it locally and will be submitting a patch to ICEfaces.
Thanks again for the help with finding the real cause.
Ed