JSF stores session scoped managed beans as session attribute using managed bean name as key. So the following should work (assuming that JSF has already created the bean before in the session):
MyBean myBean = (MyBean) request.getSession().getAttribute("myBean");
That said, I have the feeling that you're looking in the wrong direction for the solution. You could also just do like follows:
with the following in a request scoped bean associated with profile.jsf
@ManagedProperty(value="#{param.userId}")
private Long userId;
@ManagedProperty(value="#{sessionBean}")
private SessionBean sessionBean;
@PostConstruct
public void init() {
sessionBean.setUser(em.find(User.class, userId));
// ...
}