Even though the JSP 1.2 spec is a bit vague on the subject, I'm pretty sure the intention is that the auto-discovery of TLDs includes TLDs located directly in the file system under WEB-INF, but the org.apache.jasper.compiler.TldLocationsCache class only looks for TLDs in JAR files under WEB-INF/lib. For consistency with which TLDs are used when scanning for listeners, I suggest including all TLDs under WEB-INF (in addition to JAR files under WEB-INF/lib and web.xml mappings) when the map is created. I'll try to get this clarified in JSR-152.
Looks like this one only got fixed for TC 5. I'd appreciate it if someone can port it to TC 4.1 as well (it doesn't work in TC 4.1.18, have not tested 4.1.19 yet). It's been clarified by JSR-152 that the auto-discovery of TLDs includes TLDs located directly in the file system under WEB-INF (for JSP 2.0, but there's no reason not to do the same for JSP 1.2).
I did port the changes back to TC 4.1, but they were not picked up by TC 4.1.18. They have been picked up by TC 4.1.19, though.
*** Bug 11739 has been marked as a duplicate of this bug. ***