In a JTA & multi-threaded environment, a timed-out transaction can cause unsafe session access to occur internally in ORM.
When AbstractEntityManagerImpl joins a transaction, it registers an "afterCompletionAction" coordinator. If the transaction is rolled back and the session is still open, the coordinator clears the session.
This causes problems in multi-threading within one transaction. If a thread is in the middle of an EntityManager#find, for example, and the transaction times out, a reaper thread will kick off the afterCompletionAction and clear the session. Depending on timing, this removes the EntityEntry from the persistenceContext, prior to the fetch attempting to use it in the other thread. This results in a "possible non-threadsafe access to the session" AssertionFailure.
This will be tricky (or impossible) to simulate with a unit test. To reproduce, I've been putting a breakpoint in the first line of TwoPhaseLoad#initializeEntity and then using this test:
The low transaction timeout value and the breakpoint will cause the reaper to clear the session and cause the failure.