Although the implicit objects are local the attributes set in these objects may be instance variables or class variables accesible to other implicit objects as well thus nullifying the thread safe concept Suppose the _jspService method creates an implicit object request and then add to it's attributes a static object which is accessible to other request objects thus nullifying the thread Safe concept. Well it depends on how you design your JSP taking into consideration all the aspects of making best use of thread safe concept.
IF you would follow these steps the whole thing will become clear.Here is how it goes about. 1.in the doStartTag the the implicit out object of pageContext is used for writing the response to client.obtained by using pageContext.getOut() 2. Now if the doStartTag method returns EVAL_BODY_BUFFERED then a new bufferedobject is created by filling that object with the contents of the body in between the tags.As you must me aware of a stack(LIFO STRUCTURE) this buffered object is stored in the stack when the pageContext.pushBody() is executed(all this stuff is done all by itself internally so don't worry about it) now if try to acess the out object using pageContext.getOut() what we get is the BodyContent object and not the one to write to the client. Now when we enter the doEndTag() the pageContext.popBody() is executed removing the bodyContent objectt.In this we now have our implicit out object again for writing back to the client.Simple as this