Concurrency issue in underlying Tomcat web server.

Please see the Tomcat bug:
http://issues.apache.org/bugzilla/show_bug.cgi?id=36541

It might not be so bad if developers could actually access all of the places the HttpSession is accessed to synchronize everything. There may very well be specific JBoss features affected by this as well.