I might be blind to not have seen that before, but this here hit me over the third Guinness at an Irish Pub while answering a sudden technical question from my buddy Bart:

<wsa:ReplyTo xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/03/addressing">
 <wsa:Address>http://server/service_second_intermediary</wsa:Address>
 <wsa:ReferenceProperties>
  <wsa:ReplyTo>
   <wsa:Address>http://server/service_first_intermediary</wsa:Address>
   <wsa:ReferenceProperties>
    <wsa:ReplyTo>
     <wsa:Address>http://server/service_outer_caller</wsa:Address>
    </wsa:ReplyTo>
   </wsa:ReferenceProperties>
  </wsa:ReplyTo>
 </wsa:ReferenceProperties>
</wsa:ReplyTo>

Read the EPR binding rules section 2.3 in the WS-Addressing spec and you'll find out just like me how distributed "call-stacks" work with WS-Addressing, if your choice of communication pattern is the far more flexible duplex (or here) pattern for datagram-based message conversations instead of the rather simplistic request/response model. Of course, any endpoint-reference can be stacked in the same way. I always wondered where the (deprecated) WS-Routing "path" went, which allowed specifying source routes. I think I ran into it.

Updated: