In a word, no. The HttpSession Attribute list is usually backed by a HashMap and so it can grow unconstrained. As for performance, the speed of retrieval of objects is constant, but the problem you may run into is the memory usage of the server if you have many sessions.
A servlet engine has the option of serializing sessions out to disk if it wants to due to memory getting tight. (Not all servlet engines implement this, I know JRun does.) Thats why all objects you put in a session should implement Serializable. Naturally recovering a session from disk introduces a delay. Bill