Its a bug, can you file a support ticket with that stacktrace?
UPDATE
Looked into the code, if you apply the following patch I expect the problem to be gone (not tested yet)
Replace the releaseOldLocks method at javasource/communitycommons/ORM.java line 313 with:
public synchronized static void releaseOldLocks()
{
Set<ISession> activeSessions = new HashSet<ISession>(Core.getActiveSessions()); //Lookup with Ord(log(n)) instead of Ord(n).
List<Long> tbrm = new ArrayList<Long>();
for (Entry<Long, ISession> lock : locks.entrySet())
if (!activeSessions.contains(lock.getValue()))
tbrm.add(lock.getKey());
for(Long key : tbrm)
locks.remove(key);
}