Pure SQL goes inside the formula attribute/element, hence its appropriateness when hardcoding stuff. Whatever you put in there is put directly into the end result where clause. There is no substitution of any kind.
So you could put "<many-to-one class="State" formula="name='Florida'"/>". Or
Code:
<many-to-one class="State">
<formula>name like 'A%' and ((select s.population from state s where s.name = name) > 1000000)</formula>
</many-to-one>
You have to use subselect for referencing other tables, even if they're already referenced elsewhere in the mapping, because you have no way of determining what alias hibernate has assigned to the other table. It's not efficient, but it is effective.