I found that the loop also appeared in manually created configs by assigning a very simple access profile to any virtual server. So it wasn't just happening to configurations created by the exchange iApp.
Downgraded to 11.2.0 Final, build 2446, loaded default configuration and re-made the basic setup of our boxes, and the loops disappeared.
Loaded default config again and upgraded to 11.2.0 HF3, and the loops came back.
At this time, support came back with an answer that this problem was due to a known issue, so I never tried 11.2.0 HF1 or 2.
Didn't get any details about the issue, but they supplied us with a workaround which meant reassigning session.server.landinguri to a dummy URI before all logon pages, and directly after the logon page, assigning landinguri the original value.
Our access profiles now looks like the attached image.
The first variable assign ("fix landing") contains
session.server.templandinguri = mcget {session.server.landinguri}
session.server.landinguri = return { "/dummyuri" }
The second one ("fix landing(1)) contains
session.server.landinguri = mcget {session.server.templandinguri}
After that, no more loops.
/Andreas