So other folks can tell what the resolution was, without going to the bug database, here's what I wrote in the bug:
--------------
I talked with Ryan and Ed about this, and here's what they said, paraphrased.
Essentially, this is expected behavior.
Imagine a case where you have multiple tabs open, or press the back button - in
both cases, under the case where you're doing a GET, you'd expect the state to
be there - otherwise, you'll get a ViewExpiredException.
This means that if you also do <h:link> this will also be the behavior.
The views will all be reaped when the session expires, of course, which is often
set to 30 or 60 minutes.
There's also a configurable limit to the number of views - 15 is the default,
and it's a LRU (Least Recently Used) queue.
[Message sent by forum member 'driscoll' (jim.driscoll_at_sun.com)]
http://forums.java.net/jive/thread.jspa?messageID=367362