I'm assuming you are talking about Artix and not FUSE since FUSE doesn't (yet) support CORBA....
That said, in THEORY, you should be able to set the BindingProvider.ENDPOINT_ADDRESS_PROPERTY on the client to a new URL/IOR just like you would for HTTP. I'm not sure if the CORBA binding supports that or not. You'd have to give it a try and see. If not, we'll need a bug logged.
Sorry about the confusion Dan, I should have left out the CORBA reference. Indeed I was using Artix, but I suppose the same would be true if I was using CXF and invoking on a HTTP endpoint that acted as a factory returning EPRs for a PortType that did not have its location specified in the local WSDL, but was in the address of the EPR instead. I'll have a look at a CXF demo on this and see if it still makes sense to use the ServiceImpl class to get the port.