BOL says in the article "Creating User-defined Functions (Database Engine) ":

"The number of times that a function specified in a query is actually executed can vary between execution plans built by the optimizer. An example is a function invoked by a subquery in a WHERE clause. The number of times the subquery and its function is executed can vary with different access paths chosen by the optimizer."

So the real answer maybe not "one per row outside of FROM" but "whatever, more the one"