In general, only "method" variables (declared in <% %> are definitively thread safe in JSPs. Class ("static") variables are not. Object (instance) variables are not. Variables stored in application and session contexts are not. Variables stored in request or page contexts are probably thread safe, unless they are also one of the unsafe categories above.
To add...I guess the instance variables are thread safe if the JSP page has the directive (<%@ page isThreadSafe=false)..it is like JSP page implementing the SingleThreadModel...people correct me if I am wrong..