Thanks for all your input.
Im using Tomcat 5.5 and I eventually looked inside the generated JSP class files (that Tomcat generates) to see if I could see anything.
It looks like Tomcat maintains a pool of tag instances (my tag extended BodyTagSupport) that it stores in the servlet context - I'm guessing this is for performance reasons. And this to me explains why I was getting application wide access to it.
I never manipulate the tag attributes (setting them to null etc), but I was passing values from a few nested child tags to their common parent ... something like this :
<cb:childTag name="1" attr="val1">
<cb:childTag name="2" attr="val2">
So child 1 and 2 both passed the attr values ("val1" and "val2" respectively) through to the parent (the child tags have no body) by calling a protected method of the parent tag (that I looked up with getParent()).
The parent keeps the supplied attr values in a list and then in the doEndTag() method it does some processing and outputs the results.
Hope this is making sense.