Why would it listen to 1433? :-) 1433 is a well-known port for a default instance. For a named instance ( like your express), the db engine asks Windows for an available port number (there's a range for these purposes). This port number is stored in the registry and used for subsequent starts of the engine. Unless the port is unavailable, then Windows is asked for a different port (or, if "static" port is chosen, the engine refuses to start).
Note that the documentation referred to in the other answer is incorrect. It suggests that a different number is chosen at every startup. That isn't correct. Imagine the amount of work the "firewall-people" would have! :-)
For instance, here's the registry path for an instance on my machine, named "A":
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\A\MSSQLServer\SuperSocketNetLib\Tcp
In here, there's an entry named "TcpPort" with the value of the port number that this instance is using. This is why I see the same port number even after re-starting my instance.