PPPoFR on multipoint interface question

Consider this simple setup:

R1 102 ------ 201 R2 203 ------ 302 R3

Here, PPPoFR is used to configure a common subnet 10.10.123.0/24 on R1, R2 & R3 with R2 being the hub. For each DLCI, it seems the router will clone a virtual-access interface from the virtual-template making the mutlipoint interface really a collection of point-to-point interfaces, as can be seen in the following routes:

C       10.10.123.0/24 is directly connected, Virtual-Access1
                          is directly connected, Virtual-Access2
C       10.10.123.1/32 is directly connected, Virtual-Access1
C       10.10.123.3/32 is directly connected, Virtual-Access2

This makes perfect sense.

Now. if you configure "no peer neighbor-route" on the virtual-template, the host routes will be removed from the routing table, leaving only the following route entry:

C       10.10.123.0 is directly connected, Virtual-Access1
                             is directly connected, Virtual-Access2

Now it seems without the host routes, R2 is load sharing between R1 and R3. I originally thought this is a problem as half of the packets will be sent to the wrong destination if you ping R1 or R3 from R2. But that's not the case. It looks IOS is smart enough to decide which virtual-access interface to use even without the host routes.

My question is, what information does the IOS use to make that decision? Is there any command to display such information?