I believe setSessionForm only lets the form know to be session aware (though it doesn't seem to work as I expect with regards to caching a command object).
that's true. following is an excerpt from Spring source
Code:
/**
* <p>Form controller that autopopulates a form bean from the request.
* This, either using a new bean instance per request, or using the same bean
* when the <code>sessionForm</code> property has been set to <code>true</code>.
*...
*/
SimpleFormController will use your bean only if it is already instanciated and stored in the HttpSession.