With HttpSessionReplication enabled, an object that implements HttpSessionBindingListener is placed in the session. When the session times out, valueUnbound() is never called.

This was reported by a support customer and is found in case 2748: https://na1.salesforce.com/50030000000aiwP

I have attached a simple WAR to the case that reproduces the problem.

It may be that the other related listeners from the servlet spec are not working as well, but this has not been tested.