The underlying problem was client-side DOM corruption due to a <ul> being used outside a <form>. This caused
mojarra.dpf = function dpf(f) {
var adp = f.adp;
if (adp !== null) {
for (var i = 0; i < adp.length; i++)
{
f.removeChild(adp[i]);
}
}
};
to fail because the hidden field added to the form did not have the form as a parent (this would seem to be impossible, but the behavior of IE7 appears to be completely undefined in this case).
Test case is on page.jsf.