In the event that any default values are present, a separate environment record is created for parameters.
The semantics of functions declared in this position are such that this environment record defines their local scope. A note in the spec (see clause 28) says:
NOTE: A separate Environment Record is needed to ensure that closures created by expressions in the formal parameter list do not have visibility of declarations in the function body.
More from the spec:
When an execution context is established for evaluating an ECMAScript function a new function Environment Record is created and bindings for each formal parameter are instantiated in that Environment Record. Each declaration in the function body is also instantiated. If the function's formal parameters do not include any default value initializers then the body declarations are instantiated in the same Environment Record as the parameters. If default value parameter initializers exist, a second Environment Record is created for the body declarations. Formal parameters and functions are initialized as part of FunctionDeclarationInstantiation. All other bindings are initialized during evaluation of the function body.
In the absence of default arguments, therefore, I deduce that one of the pre-existing lexical environments (VariableEnvironment or LexicalEnvironment) is used for parameter bindings. Maybe.