Here's the code for ProfileBase.Create():
public static ProfileBase Create(string username, bool isAuthenticated)
{
    if (!ProfileManager.Enabled)
    {
        throw new ProviderException(SR.GetString("Profile_not_enabled"));
    }
    InitializeStatic();
    if (s_SingletonInstance != null)
    {
        return s_SingletonInstance;
    }
    if (s_Properties.Count == 0)
    {
        lock (s_InitializeLock)
        {
            if (s_SingletonInstance == null)
            {
                s_SingletonInstance = new DefaultProfile();
            }
            return s_SingletonInstance;
        }
    }
    HttpRuntime.CheckAspNetHostingPermission(AspNetHostingPermissionLevel.Low, "Feature_not_supported_at_this_level");
    return CreateMyInstance(username, isAuthenticated);
}
private static ProfileBase CreateMyInstance(string username, bool isAuthenticated)
{
    Type profileType;
    if (HostingEnvironment.IsHosted)
    {
        profileType = BuildManager.GetProfileType();
    }
    else
    {
        profileType = InheritsFromType;
    }
    ProfileBase base2 = (ProfileBase) Activator.CreateInstance(profileType);
    base2.Initialize(username, isAuthenticated);
    return base2;
}
Looks like it always returns a new instance of ProfileBase.