The ActionForm instance is not threaded, so if your server receives 1000 HTML requests, 1000 instances of your ActionForm will be created.
However, if you specify "request" as the scope, each instance is available for garbage collection as soon as the server returns a response to the browser.
If you specify "session", you have only one instance per actual user of the system. If you're using session as the scope for any of your forms, it's wise to take steps to see that they're taken out of session scope as soon as the user moves on to another page. That way, at any given time, there is only one ActionForm per user in the session.