You should analyze the ArrayList, if the ThreadWithAttributes are growing you may have a session or objects that holds references of it and it's get never released by GC.
If you can reproduce it in a smaler dev-environment you can use a profiler (i.e. eclipse, netbeans or iProfiler) there are several useful view to follow the references.
Also I would not bar a bug in the old AS4.0, but this can be checked if the problem happens after app changes.
Other people who seem to have run into an issue that gave out same signs as your issue, mostly find out that it is their internal application issue where their code causes Tomcat/JBoss Web threads to keep data in that thread, meaning it is not a Tomcat issue.
I would look into your application and look at what could it be.