where Person is an abstract class (with private name property and standard getName, setName methods) and Employee is a concrete subclass of Person(with private empID property and standard getEmpID, setEmpID methods).
When the Container builds the resulting servlet for this JSP, then a bean called "person" is either selected or created (if doesn't exist in page context) that has an object type of Employee that has a reference type Person.
Person person = new Employee();
Now polymorphically speacking, "person" should not be able to call the setter method in Employee (can only call methods in Person), but yet, the container can set both properties. Doesn't this violate the polymorphism rule in plain java?
Possibly. But the jsp:setProperty tag uses reflection to get/set properties. As such, it bypasses the rules of java types. It sees that the object actually IS of type Employee, and has a property called empID.
If you attempted to use this class in scriptlet code, then the rules would be applied. ie <%= person.getName() %> would work, but <%= person.getEmpID() %> would not.