This patch was authored and released by @gwynne.
The accessor for Application.http.client.shared was performing a lookup in the storage dictionary using double-checked locking, which is not actually thread-safe (despite all appearances to the contrary). It now unconditionally takes the lock before performing the lookup.
Applications making heavy use of Request.client or Application.client may experience a performance regression from this change.