However my understanding of databinding is that if this action is invoked without any parameters, the argument should be assigned a new User()
That is not necessarily the case. For domain class command objects if no parameters are present a new instance is only created for POST requests.
From http://grails.org/doc/2.4.0.RC1/guide/theWebLayer.html#commandObjects...
If the command object's type is a domain class and there is no id request parameter then null will be passed into the controller action unless the HTTP request method is "POST", in which case a new instance of the domain class will be created by invoking the domain class constructor.
That text may be missing from the 2.3.8 docs. I will verify that and add it if necessary.