I was using JBoss 2.4.4, and I recently switched to 3.0.2. When I would hit certain servlet pages, I would get AccessControlException, and then the server would continue to throw AccessControlException's every three seconds or so. When I would shut it down, I got several hundred more AccessControlException's on the way down.
I finally figured out the problem, and I wanted to post it here. Because of using RMI, I was calling System.setSecurityManager(), which was the culprit. I took that out and I no longer got the error.