The Glassfish project uses a JavaCC-generated parser to parse the JSP expression language. I grabbed the parser from the Glassfish CVS repo and here's a JJDoc'd version of it.

This grammar is interested because all the productions return an Object of some sort. The start symbol, ExpressionString, returns a String, an Expression, or an ExpressionString, and each of the lower level productions parses out its tokens and gloms them into a returned object. I think I'm used to seeing JJTree grammars where most of the real work is done in with a visitor outside the grammar file, so this pure JavaCC grammar looks a little different. Also, I'm not sure exactly how this parser is used - is the start symbol always called or are there places where other productions act as the start symbol?

The lexical specification is pretty straightforward; it uses two lexical states (including DEFAULT) and pretty much skips everything outside expressions (e.g., outside ${ ... }). I like the one token definition - BADLY_ESCAPED_STRING_LITERAL - hehe, you can tell they've had to deal with some iffy code.

Finally, work continues on my forthcoming JavaCC book... steady progress and it's very cool stuff.