This is quite fiddly, but you can do this by querying the JBoss MainDeployer MBean. The MBean is found at jboss.system:service=MainDeployer, and has a JMX operation listDeployments. This returns a collection of DeploymentInfo objects, one of which will be your EAR deployment. That DeploymentInfo has a url property which is a file:// URL describing your deployment directory.
Nice, eh? You can use the raw JMX API to do this, but Spring provides a much nicer mechanism, using a MBeanProxyFactoryBean to expose an instance of MainDeployerMBean.
I'd like to find a simpler way, but that's the best I've found so far.