Asked this on forums.asp.net but got no takers, so I thought I'd try here.
We've got an HttpModule that registers for BeginRequest, ReleaseRequestState, and EndRequest. The main purpose of the module is that when we're serving regular html pages, we want a hook to re-write and encrypt the query strings on hrefs in the generated html. The filtering is attached in the ReleaseRequestState event handler of our module (context.Response.Filter = new MyFilter(...);).
But when we're running a page that's going to result in an xml document, the ReleaseRequestState event handler doesn't appear to fire at all - only BeginRequest and EndRequest.
After a lot of googling, I found posts that say HttpApplication.CompleteRequest() will bypass a lot of the event chain and go directly to EndRequest, but nowhere do we call CompleteRequest(). So I'm thinking there are other things lower down that call it, or other ways of bypassing ReleaseRequestState.
When we set up to produce the report xml, we do a Response.Clear(); and then create an XmlWriter on Response.OutputStream. Would either of those cause something lower down to bypass the ReleaseRequestState event?
Because you're serving up an XML document, the ASP.NET pipeline is short-circuiting - there's no state to release since there's no aspx page executing that used it.
What you could do to get around this is to make sure that you're POSTing the session state form variable with the request for the XML document. When the framework sees that variable (and/or other request params pertaining to state) it will perform the full state hydration/dehydration event cycle.
EDIT:
After thinking about this some more, I think that it's the call to Response.Clear() that is causing the state events not to fire. That method will clear existing content including state variables contained in the request. Since it seems you may be calling Response.Clear in the BeginRequest event handler, the state is being cleared from the request before it is being parsed and set in subsequent events. Hence, there's no state to release and the event invocation is being skipped.
Have you downloaded/pointed symbol sources at the ASP.NET source and stepped through a request? That would help answer this even better.