How can I get picklist values using Dynamic Visualforce Bindings?

This is impossible to do even with regular visualforce. The following page will give you the same error at compile-time that you see at runtime with dynamic vf.

<apex:page>
    {!$ObjectType.Account.Fields.Industry.PicklistValues}
</apex:page>

I ran into this issue about a year ago and there is no workaround except returning the list of picklistEntries from the controller. Ex:

<apex:page controller="picklistentryController"> 
    <apex:repeat value="{!entries}" var="val">
        {!val.label}<br/>
    </apex:repeat>
</apex:page>

public with sharing class picklistentryController 
{
    //for dynamic vf simply build a map of fieldnames to lists of picklistentries,
    public list<Schema.Picklistentry> getEntries(){
        return Account.fields.Industry.getDescribe().getpicklistvalues();
    }   
}

NOTE: If you are supporting multiple languages and using the apex:page lang parameter to set the language of the page anything referenced in apex (picklistentry labels in this case) will ignore the parameter and be returned in the language of the running user instead.

As Greg Grinburg says, it is impossible to achieve the result you want through dynamic VisualForce bindings alone.

However, it may be worth noting that your workaround can have an equivalent degree of flexibility if that flexibility is worth the verbose syntax.

Controller

class MyController
{
  public Map<String, Schema.SObjectType> schemaInfo 
  {
    get { return Schema.getGlobalDescribe(); }
  }
}

Page

<apex:page controller="MyController">
  <apex:repeat 
     var="pv" 
     value="{!schemaInfo['MyObject__c'].describe.fields.map['MyPicklistField__c'].describe.picklistValues}"
  >

    {!pv.label}<br/>

  </apex:repeat>
</apex:page>