You are not allowed to spawn your own threads, hence the Application Error. This is mandated by the spec, so you won't find a work around via a deployment descriptor.
Does the state need to be held in a Stateful Session Bean? You could store it in a local Java Object (stored in the users Session if you are using a Servlet Engine), and when ready, you could pass the Java Object (as a serialised object) to the processing Stateless Session Bean. You could then implement your own locking for the Java Object, which should be very simple (if the locking turns out to be complex, then maybe you need to take another look at your workflow).