I'm not a state saving expert. That said:
Data that has a session scope will be stored in the session, where it belongs. But data that's store elsewhere (like Request Scope) is stored in a more appropriate place - in that case, in an internal map.
I'll let others more knowlegable than I flesh out more details.
[Message sent by forum member 'driscoll' (jim.driscoll_at_sun.com)]
http://forums.java.net/jive/thread.jspa?messageID=363839