The author says here:
http://java.dzone.com/articles/session-and-clustered-java-web
that:
With servlets, you have the power to put objects into and take objects out of session yourself. Alone, this presents thread-safety issues….
Now session is one per user. So as part of a user request, when the user is manipulating the session, no otehr request can manipulate the same session. So how we will have thread safety issues here?
If the same user using the same browser and opening more than one tab, then it is possible two requests manipulating the same session.