I'm using Tomcat 5.5.28 (definitely can't upgrade to 6). Is that known to have a bug in its JSP implementation?
Assuming a bug is a mistake on your part. I usually find that when people think they've found a bug in a piece of software it's really just some behavior that doesn't conform to their incorrect assumptions about how things work. Sometimes bugs are found, but they're rare. Especially for things like JVMs that have been out in the wild for a long time.
From Sun:
The scope in which the Bean exists and the variable named in id is available. The default value is page. The meanings of the different scopes are shown below:
page - You can use the Bean within the JSP page with the element or any of the page's static include files, until the page sends a response back to the client or forwards a request to another file.
request - You can use the Bean from any JSP page processing the same request, until a JSP page sends a response to the client or forwards the request to another file. You can use the request object to access the Bean, for example, request.getAttribute(beanInstanceName).
session - You can use the Bean from any JSP page in the same session as the JSP page that created the Bean. The Bean exists across the entire session, and any page that participates in the session can use it. The page in which you create the Bean must have a <%@ page %> directive with session=true.
application - You can use the Bean from any JSP page in the same application as the JSP page that created the Bean. The Bean exists across an entire JSP application, and any page in the application can use the Bean.
I would recommend trying session scope.