Pick a directory, devise a naming scheme to prevent collisions. Be CERTAIN to close the files explicitly.

Shellman is right about doing something like this in an async fashion if you can (MDB). Just send a url for the file as the message. Then you can dump the file into a private web server's doc area, put it into an ftp server, or use the local file system and let the bean retrieve it based on whatever url scheme you're using. This is best if you can process the file in a streaming sort of fashion - otherwise you might as well pick a directory and go with it.

Also, what's your process location strategy - is the session bean colocated in the web tier or in another tier? Sharing file systems gets trickier if you have to span machines. I'm not a fan of NFS in a high availability environment or in putting beans in separate processes if you can avoid it. The distribution mechanism is many orders of magnitude slower than local calls and adds little value.