I too got thinking about it.

Only one instance of the compiled servlet class of the JSP runs in the
container's memory. So, multiple requests to the server would mean, the
same java class(of the jsp) executing, via multiple threads. If the Jsp
has data members, they can be corrupted. Even though, different
stateful EJB exist for different requests, the JSP instance remains the
same.

Is it a good practice to avoid private data members in JSP and
servlets. I have never seen anything like that. ( Looking at existing
code gives a very good idea of how to use stuff ).

What if your JSP has private data members? Will it have every chance of
inconsistent data.

By the way, to be safe, do not call the EJB directly from the JSP. Use
a delegate, a simple java class instantiated for every call to the JSP,
which in turn handles the EJB, and returns data back to JSP.