Currently the method org.apache.jasper.runtime.TagHandlerPool.reuse(Tag 
handler) - subproject jasper - has the following implementation:

    public void reuse(Tag handler) {
        synchronized( this ) {
            if (current < (handlers.length - 1)) {
                handlers[++current] = handler;
                return;
            }
        }
        // There is no need for other threads to wait for us to release
        handler.release();
    }

Where the handler.release() method of the returned TAG is called after the tag 
is returned to the pool and outside of the synchronization block. This is 
obviously wrong, because another thread can obtain the same tag from the pool 
and start use it, where at the same time the TagHandlerPool will release the 
tag (i.e. the tag will free its internal properties)! On a highly frequented 
site, this is very likely to happen simutaniously and the state of the tag will 
be inconsistent.

The solution is very simple: Call the handler.release() Method before the tag 
is returned to the pool, or synchronize it.

Regards
Peter