According to the specification the web service client is expected to use the value in //wsdl:port/wsa:EndpointReference/wsa:Address as the value in //soap:Header/wsa:To in the SOAP message. Likewise, all elements defined in //wsdl:port/wsa:EndpointReference/wsa:ReferenceParameters/ should be inserted into the SOAP Header as separate elements with the wsa:IsReferenceParameter="true":
I have confirmed this behavior in JAX-WS implementations. However, soapUI does not seem to read this information from the WSDL and fails to include the ReferenceParameters elements. I would suggest this is a bug. Also, the "Add default wsa:To" should be chacked when the port is extended with a wsa:EndpointReferenced and WS-Addressing is enabled.