How do you know that "it is automatically released
by the operating system?"

The documentation for CryptAcquireContext states:
"When you have finished using the CSP, release the
handle by calling the CryptReleaseContext function."

In the example code provided, the wording in the comments
is even stronger:
"When the handle is no longer needed, it must be released."
The example code then explicitly calls CryptReleaseContext.

Do you know absolutely for certain that we are not
leaking resourses if we violate this clear API
requirement?

Reference:
http://msdn2.microsoft.com/en-us/library/aa379886.aspx