In the current WS-Addressing specification, endpoint references (EPRs) are capable of holding only a single service address. In fact, the name "endpoint reference" implies this -- it's a reference to a single endpoint. One question implied by this design is fairly obvious: what do you do when the address indicated by an EPR fails?
If the application using the failed EPR originally retrieved it from some sort of lookup or directory service, then presumably the app can go back, do another lookup, and get a new or different EPR. This assumes that the service that the EPR refers to is available at multiple endpoints and also that the service advertised its multiple EPRs in the directory service. It also assumes that the directory service is capable of storing multiple EPRs under a single service name or description, and also that it hands out the EPRs in some kind of round robin, random, or other fashion such that calling applications won't get the same EPR each time they ask. That's a lot of assumptions.
If the application got the failing EPR from some other application, perhaps as part of some message, then what? Unless the returned message has somehow accounted for the possible failure of the EPRs it contains and has provided multiple EPRs for each service endpoint such that the app can try each one, then the app is stuck with a failing EPR, and it won't be able to reach that service at all.
One might argue that the machinery for high availability lies "below" the address contained within an EPR, such that EPRs need not account for these types of failures. For example, the same approaches used to distribute load across multiple web servers could be used to try to ensure that at least one instance of the service is alive and ready at the endpoint indicated by the EPR. This is indeed one viable approach, but it should not be the only possible one.
I think this is another reason to allow endpoint references or service references to contain information for multiple endpoints. A composite endpoint reference could refer to a single logical service, but hold physical addresses for multiple endpoints, such that an application encountering a failure using one such physical address could go back to the same EPR and try a different address. Allowing this alleviates the need for other machinery either above or below the EPR level to ensure service availability. The current EPR design, however, forces you to use some other approach to allow for such availability.