Two things matter here: target bitrate and bit-reservoir. Target bitrate is defined by the user, bit-reservoir is defined (indirectly) by the maximum frame size, which is defined by the standard to be 6144 bits per channel: bit reservoir = max frame size - average frame size.
Target bitrate gives you AVERAGE (wishfull) frame size. If there are saved bits in the bit-reservoir, encoder can borrow them in case it has a hard-to-encode frame. This means that, hipoteticaly, your (stereo) frame at 128000 bps can have the bitrate of 529000 bps (you do the math!), and you can still call it a CBR. It just isn't that meaningfull to base your conclusion on a single frame. The following frames will have an empty bit-reservoir and their bitrate will have to be less than or equal to the average. Eventualy you will end up with average bitrate more or less close to your target bitrate.
The most common thing among present AAC encoders is saving bits to bit-reservoir during the stationary parts of the signal (encoding at lower bitrate) and spending this saved bits at harder parts of the signal (transients, etc...) if/when they come.
And yes, there are encoding apps that offer CBR/VBR option, Nero for example.
Take a look
here to see how "CBR" really looks.
Daniel