Thanks so much for all your insightful explanations and your patience with a beginner! I think I figured it out now. @Preben Alsholm's and @acer's hints at 'escaped locals', the 'hardware-package'-functions and tools/genlocal pointed me in the right direction.

Here's how I think it works:

The 'z' passed from my function f to g and h and also the 'z' returned by proc() local z; z end proc are not merely identifiers to be evaluated via an identifier table of sorts. They are internally represented by a NAME-structure (ProgrammingGuide, Appendix) which beside the identifier contains a field assigned-expr. So when 'z' is passed to (or returned from) a function, what is passed (or returned) behind the scenes is actually an identifier and a value! This is why 'z'  can be evaluated wherever: Evaluation in this case is nothing more than looking up the assigned-expr field of the NAME-structure.

@Preben Alsholm 

Thank you for your answer!

I like the example at the end of your answer. It's actually a lot clearer, than mine. So how does that work? The way I understand it is:

1. p returns the symbol z. (Is that even true, or does it return some other kind of object?)

2. The line  %;  evaluates the symbol z to 2. But how? Does the symbol z carry with it some sort of context? If so, can I inspect that context somehow?

Edit: The first part of your answer I can see. That's exactly the output, I would expect, when I leave out eval.