This week's book giveaway is in the OCAJP forum. We're giving away four copies of OCA Java SE 8 Programmer I Study Guide 1Z0-808 and have Jeanne Boyarsky & Scott Selikoff on-line! See this thread for details.
In general, only "method" variables (declared in <% %> are definitively thread safe in JSPs. Class ("static") variables are not. Object (instance) variables are not. Variables stored in application and session contexts are not. Variables stored in request or page contexts are probably thread safe, unless they are also one of the unsafe categories above.
To add...I guess the instance variables are thread safe if the JSP page has the directive (<%@ page isThreadSafe=false)..it is like JSP page implementing the SingleThreadModel...people correct me if I am wrong..