It is kept inside the current HttpContext. If you decompile the code you will see it:
public static bool CatchAccessDeniedException
{
get
{
HttpContext current = HttpContext.Current;
if (current == null)
return false;
string str = (string) current.Items[(object) "CatchAccessDenied"];
if (!string.IsNullOrEmpty(str))
return str.Equals("TRUE", StringComparison.InvariantCulture);
else
return true;
}
set
{
HttpContext current = HttpContext.Current;
if (current == null)
return;
current.Items[(object) "CatchAccessDenied"] = value ? (object) "TRUE" : (object) "FALSE";
}
}
So the setting you make is valid during the HttpRequest lifecycle.