Consider a page containing a form and an AJAXy component (as in an AJAX link or a panel with AjaxSelfUpdatingTimerBehavior). The form contains code, that makes its processing take relatively long time, even when validation fails (let's say we forgot to fill in a requred field). The form gets submitted, and while it's processing, the AJAX component triggers a request (AJAX link gets clicked, or AjaxSelfUpdatingTimerBehavior kicks in). While the AJAX request gets served, cleanupFeedbackMessages() is called, wiping all feedback messages found by WebSession.MESSAGES_FOR_COMPONENTS filter.
WebSession.MESSAGES_FOR_COMPONENTS implementation (or its usage in cleanupFeedbackMessages()) is a little bit fishy, as it accept()s messages, that haven't been rendered.
Will add testcase.