If you synchronise the list object itself, you won't be able to stop it being removed as an attribute from the scope... Someone could still invoke, for example, session.removeAttribute("userList") or session.setAttribute("userList") to remove or replace it, respectively, and there's nothing you can do. Synchronising on the session/context object itself prevents removal/replacement and also prevents other objects from obtaining a reference to the scoped variable using getAttribute() - the only thing it doesn't do is prevent modification to the list contents if they already have a handle on the list (which is unlikely if they couldn't call getAttribute()).
Hope that helps.
Charles Lyons (SCJP 1.4, April 2003; SCJP 5, Dec 2006; SCWCD 1.4b, April 2004)
Author of OCEJWCD Study Companion for Oracle Exam 1Z0-899 (ISBN 0955160340 / AmazonAmazon UK )