Steps to Reproduce

1. create a separate thread to edit cells under a collaboration mode like:

    class UserEdit implements Runnable {
        private int id;
        private Desktop desktop;
        private Sheet sheet;

        public UserEdit(int id, Desktop desktop, Sheet sheet) {
            this.id = id;
            this.desktop = desktop;
            this.sheet = sheet;
        }

        @Override
        public void run() {
            for (int row = id; row < 30; row++) {
                for (int col = 0; col < 20; col++) {
                    try {
                        Executions.activate(desktop);

                        Range range = Ranges.range(sheet, row, col);
                        range.setCellEditText("user " + id);
                        CellOperationUtil.applyFontColor(range, genColorCode());
                        CellOperationUtil.applyBackColor(range, genColorCode());

                        Executions.getCurrent().setAttribute("TEST2", "VALUE2");
                    } catch (InterruptedException e) {
                        System.out.println("testing thread stopped");
                    } finally {
                        Executions.deactivate(desktop);
                    }
                    Threads.sleep(600);
                }
                if (row == 29) {
                    row = 0;
                }
            }
        }
    }

Current Result

15-May-2018 18:12:49.081 SEVERE [Thread-97] org.zkoss.zk.ui.impl.UiEngineImpl.handleError
java.lang.NullPointerException
at org.apache.catalina.connector.Request.notifyAttributeAssigned(Request.java:1563)
at org.apache.catalina.connector.Request.setAttribute(Request.java:1549)
at org.apache.catalina.connector.RequestFacade.setAttribute(RequestFacade.java:540)
at org.zkoss.zk.ui.http.ExecutionImpl.setAttribute(ExecutionImpl.java:497)
at org.zkoss.zk.ui.impl.AbstractExecution.setAttribute(AbstractExecution.java:178)
at org.zkoss.zss.ui.Spreadsheet.addDeferOperation(Spreadsheet.java:6609)
at org.zkoss.zss.ui.Spreadsheet.updateUnlockInfo(Spreadsheet.java:6443)
at org.zkoss.zss.ui.Spreadsheet.access$4500(Spreadsheet.java:232)
at org.zkoss.zss.ui.Spreadsheet$InnerModelEventDispatcher.onCellContentChange(Spreadsheet.java:2645)
at org.zkoss.zss.ui.Spreadsheet$InnerModelEventDispatcher.access$1400(Spreadsheet.java:2321)
at org.zkoss.zss.ui.Spreadsheet$InnerModelEventDispatcher$8.onEvent(Spreadsheet.java:2372)
at org.zkoss.zss.ui.ModelEventDispatcher.onEvent(ModelEventDispatcher.java:49)
at org.zkoss.zss.model.impl.EventQueueListenerAdaptor$WrappedListener.onEvent(EventQueueListenerAdaptor.java:107)
at org.zkoss.zk.ui.event.impl.DesktopEventQueue$QueueListener.onEvent(DesktopEventQueue.java:168)
at org.zkoss.zk.ui.AbstractComponent.onEvent(AbstractComponent.java:3165)
at org.zkoss.zk.ui.AbstractComponent.service(AbstractComponent.java:3135)
at org.zkoss.zk.ui.AbstractComponent.service(AbstractComponent.java:3077)
at org.zkoss.zk.ui.impl.EventProcessor.process(EventProcessor.java:138)
at org.zkoss.zk.ui.impl.UiEngineImpl.processEvent(UiEngineImpl.java:1846)
at org.zkoss.zk.ui.impl.UiEngineImpl.process(UiEngineImpl.java:1618)
at org.zkoss.zk.ui.impl.UiEngineImpl.endUpdate(UiEngineImpl.java:1222)
at org.zkoss.zkex.ui.comet.CometServerPush.deactivate(CometServerPush.java:522)
at org.zkoss.zk.ui.impl.DesktopImpl.deactivateServerPush(DesktopImpl.java:1596)
at org.zkoss.zk.ui.Executions.deactivate(Executions.java:1011)
at org.zkoss.zss.app.ui.AppCtrl$19$1.run(AppCtrl.java:784)
at java.lang.Thread.run(Thread.java:748)

Expected Result

no exception

Debug Information

1. in ZSS APP, in AppCtrl.initSaveNotification(), dirtyChangeEventListener also create a separate thread.
2. if we set org.apache.catalina.connector. RECYCLE_FACADES=true, we will see [SEVERE: java.lang.IllegalStateException: The request object has been recycled and is no longer associated with this facade when setting an attribute.
Ref: https://tomcat.apache.org/tomcat-8.5-doc/config/systemprops.html
3. Tomcat 8.5.15.0 source code

 /**
     * Notify interested listeners that attribute has been assigned a value.
     *
     * @param name Attribute name
     * @param value New attribute value
     * @param oldValue Old attribute value
     */
    private void notifyAttributeAssigned(String name, Object value,
            Object oldValue) {
        Context context = getContext();
        Object listeners[] = context.getApplicationEventListeners(); //1563