Hello!
Previously (in Richfaces 3.2.2GA) the following code worked:
<rich:menuItem target="_blank" submitMode="server" value="Show" actionListener="#{bean.doShow}"But in version 3.3.1GA it causes the following exception: 
Caused by: javax.faces.FacesException: java.io.EOFException 
at org.apache.myfaces.shared_impl.util.StateUtils.getAsObject(StateUtils.java:325) 
 at org.apache.myfaces.shared_impl.util.StateUtils.reconstruct(StateUtils.java:243) 
 at org.apache.myfaces.renderkit.html.HtmlResponseStateManager.getSavedState(HtmlResponseStateManager.java:187) 
 at org.apache.myfaces.renderkit.html.HtmlResponseStateManager.getTreeStructureToRestore(HtmlResponseStateManager.java:151) 
 at org.ajax4jsf.application.AjaxStateManager.restoreLogicalViewId(AjaxStateManager.java:598) 
 at org.ajax4jsf.application.AjaxStateManager.restoreStateFromSession(AjaxStateManager.java:479) 
 at org.ajax4jsf.application.AjaxStateManager.restoreView(AjaxStateManager.java:427) 
 at org.apache.myfaces.application.jsp.JspViewHandlerImpl.restoreView(JspViewHandlerImpl.java:515) 
 at com.sun.facelets.FaceletViewHandler.restoreView(FaceletViewHandler.java:316) 
 at org.ajax4jsf.application.ViewHandlerWrapper.restoreView(ViewHandlerWrapper.java:107) 
 at org.apache.myfaces.lifecycle.RestoreViewExecutor.execute(RestoreViewExecutor.java:85) 
 at org.apache.myfaces.lifecycle.LifecycleImpl.executePhase(LifecycleImpl.java:103) 
 at org.apache.myfaces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:76) 
 at javax.faces.webapp.FacesServlet.service(FacesServlet.java:151) 
It tries to reconstructs the state from "b" string (as I found out from debugging). 
I guess it is due to the new blank window doesn't contain javax.faces.ViewState hidden field, but how it worked before? And how to use 'target' attribute correctly now? 
Thank you, 
Alexey.