This week's giveaway is in the EJB and other Java EE Technologies forum. We're giving away four copies of EJB 3 in Action and have Debu Panda, Reza Rahman, Ryan Cuprak, and Michael Remijan on-line! See this thread for details.
In a word, no. The HttpSession Attribute list is usually backed by a HashMap and so it can grow unconstrained. As for performance, the speed of retrieval of objects is constant, but the problem you may run into is the memory usage of the server if you have many sessions.
A servlet engine has the option of serializing sessions out to disk if it wants to due to memory getting tight. (Not all servlet engines implement this, I know JRun does.) Thats why all objects you put in a session should implement Serializable. Naturally recovering a session from disk introduces a delay. Bill