This week's book giveaway is in the OCAJP 8 forum. We're giving away four copies of OCA Java SE 8 Programmer I Study Guide and have Edward Finegan & Robert Liguori on-line! See this thread for details.
In general, only "method" variables (declared in <% %> are definitively thread safe in JSPs. Class ("static") variables are not. Object (instance) variables are not. Variables stored in application and session contexts are not. Variables stored in request or page contexts are probably thread safe, unless they are also one of the unsafe categories above.
To add...I guess the instance variables are thread safe if the JSP page has the directive (<%@ page isThreadSafe=false)..it is like JSP page implementing the SingleThreadModel...people correct me if I am wrong..