would it ever make sense for the application to also call javax.validation.Validation#clearValidationProviderCache()

I would this - private method to only be invoked by the container. Of course it should be implemented in a thread-safe fashion (no matter who the caller is).

If we cannot have that, perhaps we should add a new static SPI that is called at application undeploy time by the container

Scott Marlow, can you detail how you'd envision this? The suggested method would act as that, only that it's hidden, not part ofthe public API/SPI.