For a Stateful Session Bean, The EJB Container creates the bean. It actually calls newInstance on the class object as opposed to calling 'new'.
From the EJB 2.0 spec:
A session bean instance�s life starts when a client invokes a create<METHOD>(...) method on the session bean�s home interface. This causes the container to invoke newInstance() on the session bean class to create a new session bean instance. Next, the container calls setSessionContext() and ejbCreate<METHOD>(...) on the instance and returns the session object reference to the client. The instance is now in the method ready state.
A Stateless Session bean is created whenever the Container needs one. Again, from the spec:
A stateless session bean instance�s life starts when the container invokes newInstance() on the session bean class to create a new instance. Next, the container calls setSession-Context() followed by ejbCreate() on the instance. The container can perform the instance creation at any time�there is no relationship to a client�s invocation of the create() method.