When a wallet is encrypted, the passphrase is required to top up the keypool, thus, if the passphrase is rarely entered, it is possible that keypool might run out. In this case, the default key will be used as the target for payouts for mining, and calls to getnewaddress and getaccount address will return an error. In order to prevent such cases, the keypool is automatically refilled when walletpassphrase is called with a correct passphrase and when topupkeypool is called (while the wallet is unlocked). Note that the keypool continues to be topped up on various occasions when a new key from pool is used and the wallet is unlocked (or unencrypted).
When wallet passphrase enrcyption becomes enabled, any unused keys from the keypool are flushed (marked as used) and new keys protected with encyption are added. For this reason, make a new backup of your wallet so that you will be able to recover the keys from the new key pool should access to your backups be necessary.
You can't call it an infinite number of times. In fact, with default settings, the 101st call will fail.
While the private keys that control the bitcoins are encrypted, the addresses corresponding to those keys are not.
Getnewaddress simply marks a private key in the wallet.dat as being used (or, to be more specific, removes that address from the key pool) and returns that address in the response.
So the private key already exists in wallet.dat prior to the getnewaddress call.