This is my understanding based on reading BIP 70 and the Bitcoin Core source, and a few tests.
A BIP 70 payment request contains, among other things, a destination address, an amount, and an HTTPS payment URL. When you open the payment request with the Bitcoin Core client (as a file or via a
bitcoin URI with an embedded link to the payment request), you are shown the Send dialog with fields pre-filled as per the request. When you click "Send", the transaction is signed, but rather than being broadcast on the p2p network immediately, a message is POSTed to the payment URL, containing the signed transactions and also a refund address. It is then the requester's responsibility to broadcast the transaction after checking that it matches the request.
So in particular, the refund address is sent directly to the recipient over HTTPS, who is responsible for storing it in case it should later be needed. It is not part of the transaction, is not sent on the Bitcoin p2p network, and never appears in the block chain (unless it is later actually used to send a refund).
Bitcoin Core will automatically generate a refund address; the GUI doesn't provide an option to let you specify it. Actually, the details are as follows: it checks for an account named
"Refund from [requester]". If that account exists and contains an address, it uses that address as the refund address; otherwise it creates the account and a new address within it (from the key pool). So you can find the refund address via the
getaddressesbyaccount console command, but it doesn't appear to be otherwise exposed by the GUI.
You can try this: there is an online payment request generator for Testnet (and its source). If you generate a request, open it with Bitcoin Core, and send the payment, you will find that
listaccounts shows a new account named
"Refund from www.bitcoincore.org", and
getaddressesbyaccount "Refund from www.bitcoincore.org" will show you the refund address that was generated and sent.