Since the JSP's placed within WEB-INF are protected you will have to use an action mapping to reach the JSP.
What you need to do is
a) Define an action path of type ForwardAction which allows you to directly goto the JSP inside the WEB-INF.
b) Call this from the current JSP using windows.open('actionname.do') either onclick or on windows load.