Sorry for the late reply. For some reason, I missed your post.
You are right in that the constructor to ValueExpressionImpl only keep the reference of the VariableMapper passed into it. However, the VariableMapper object passed is not the original one from ELContext when the ValueExpression is first created, but a copy of it. All this happens in ExpressionBuilder. Also look at VariableMapperFactory to see that copying is done lazily, viz, only copy the mappings needed for the resolution of the variable, and not the whole map.
[Message sent by forum member 'kchung' (kchung)]
http://forums.java.net/jive/thread.jspa?messageID=338260