Both the tag handler and teh method expression keep a UIComponent refernce in a local ivar.
As it seems the tag handler for the composite component exists only once in the system, that is a less big problem from the memory aspect. But still it keeps the UIComponent representing the composite component (and its children) from the last request (what about concurrent requests using the same composite component tag handler?). The ivar seems to make that tag handler not multi-thread-save.
This method expression keeps a reference to the cc UIComponent - and it ends up in the state (also with partial state saving). Including the cc UIComponent reference and it's children.
The attached patch removes the local ivar references on both.