JSF Managed Beans are simply ordinary JavaBeans that are instantiated by the JSF framework. That is, once the bean is built, it's just a regular old J2EE application-, session-, request- or page-scope JavaBean. To get access, therefore, all that you need is to get a handle on the appropriate part of the J2EE framework. And, of course, do so at a time in the request/response lifecycle when the bean actually exists in the case of request-scope beans.
Here's a snippet I use to get the HttpServletRequest: