I can't imagine why synchronization would do that, unless the MDB somehow didn't have security access to the POJO's class instance and was trying to explicitly synch on it: I think you'd have to work at achieving this.
Is the POJO internally synchronized, or is the MDB trying to synch on it? Also, I'm not quite clear: are you currently getting a security exception, or are you worried that you might if you try to access a POJO from a MDB? [ August 31, 2004: Message edited by: Max Habibi ]
No Application Server that I know of actually attempts to check for these types of violations. Using synchronized is similar to using File I/O, it is forbidden by the spec but nothing is actually stopping you. I have *gasp* used synchronized code from the context of an EJB before and, except for Sun demanding my first-born child, I haven't run into any problems. Just don't introduce any wacky race conditions and you will be fine.