They are thread safe unless you not bind them to the session/application scope. In that case it may happen that 2 requests will operate on the same bean instance.
One thing can happen in Internet Explorer if a user chooses 'open in new window' is that the new windows gets the same session id as the original windows. These windows would then be going after the same managed beans. There are many situations where this can wreak havoc unless you handle it.
ice is for people that are not already cool. Chill with this tiny ad:
a bit of art, as a gift, the permaculture playing cards