These are just wild thoughts without any support at all.
A reference to a pointer is in my mind a different thing than the pointer itself. There seems to be no doubt that the address pointer for the acad app is unchanged during your tests. And it shouldn't change, either (if you ran it in the same session).
I believe the reference you are reffering to is a pointer to a pointer (a.k.a. handle). In other words, when you are referencing an object at a specific address, you are creating a handle that points to the address of the object. That's the address that is shown, not the handle's address.
When releasing the object, you are destroying the handle and not the pointer - otherwise you would destroy the object itself.
That's the reason you should never return a released reference. It's not because the object you are returning will be destroyed - it never is - but because the reference will be released.
The numbers in the test almost seems logical. 55-1+100 = 154 is fine, but I don't get the last count because you're creating 101 references and it returns 254? Hmmm.