I also stumbled into this the other day...
In my case, the symptom manifested itself when two requests (in this case a request to two different controllers for profile images) were fired off by .js on my page directly after each other.
The two requests would sometimes respond correctly (two distinct images returned) but if you refreshed a few times, you would start finding that one (i.e. the same) image would be returned for both requests.
After some digging, it looked like both requests would be routed to one controller when the same image was returned and not to two separate controllers as expected.
So refreshing would result in a lucky packet of which controllers got what requests. Either requests were routed as expected to both controllers or both requests to either one of the controllers...
I was using action composition to inject the authenticated user:
After I changed the bean scope to SCOPE_PROTOTYPE, all worked as expected...
I have since fixed this as well by working around Spring's singleton scope (probably should answer my question :) )