Quote from http://www.jboss.com/index.html?module=bb&op=viewtopic&t=136590 : "they'll need to be thread safe or have access to them synchronized".

There's no object to synchronize against: SessionBasedClusteredSession doesn synchronization against itself:
public void writeExternal(ObjectOutput out) throws IOException
{
synchronized (this)

}

but application developers see the wrapped one (instance of StandardSessionFacade), so synchronizing against session object does not prevent from concurrency errors