I've found most of the answer, at least for Rails 3.2.x. Here's my poorly written description:
As part of rendering, ActionView::Base#prepare
creates an instance of an anonymous subclass of ActionView::Base
and adds a couple of helper modules.
Then the view_assigns
method stores the controller's instance variables in a hash in that instance.
The local variables are passed in as a hash and stored in an instance variable called locals
in the same instance.