Update 2:
Here's an even badder ass (or is it bad asser?) way. Warning: undocumented features below (but still cool):
Assume the custom tag returns a value like so:
<cfif thisTag.executionMode eq "start">
<cfparam name="attributes.name" default="Dude" />
<cfparam name="attributes.result" type="variablename" default="result" />
<cfset caller[attributes.result] = "Hello, " & attributes.name & "!!" />
</cfif>
So the result attribute of the tag expects a variable name that will be set into the caller. Now using the method below we can access that result via cfscript.
<cfscript>
test = createObject("java", "coldfusion.tagext.lang.ModuleTag");
test.setPageContext( getPageContext() );
test.setTemplatePath(expandPath('echo.cfm'));
test.setAttributeCollection({name="Todd Sharp", result="testResult"});
test.doStartTag();
test.doEndTag();
test.releaseTag();
writeDump(testResult);
</cfscript>
Update:
The solution below may cause an undesired side effect. If your custom tag returns a value you will not have access to it since the tag is called from the component the return variable gets put into the variables scope of the component, not the calling template. Of course, if you're returning a value you should probably be using a CFC anyways (as I commented above) so use at your own risk.
How about this approach (modified from Jake's):
CustomTagProxy.cfc:
<cfcomponent>
<cffunction name="onMissingMethod" output="false">
<cfargument name="missingMethodName" type="string"/>
<cfargument name="missingMethodArguments" type="struct"/>
<cfset var returnVal = "">
<cfsavecontent variable="returnVal"><cfmodule template="#arguments.missingMethodName#.cfm" attributecollection="#arguments.missingMethodArguments#" /></cfsavecontent>
<cfreturn returnVal>
</cffunction>
</cfcomponent>
echo.cfm:
<cfif thisTag.executionMode eq "start">
<cfparam name="attributes.name" default="Dude" />
<cfoutput>Hello, #attributes.name#!!</cfoutput>
</cfif>
time.cfm:
<cfif thisTag.executionMode eq "start">
<cfoutput>It is now #now()#.</cfoutput>
</cfif>
index.cfm:
<cfscript>
proxy = new CustomTagProxy();
echoTest = proxy.echo(name="Todd");
timeTest = proxy.time();
writeOutput(echoTest);
writeOutput("<br />");
writeOutput(timeTest);
</cfscript>