Even with SecurityManger disabled you should not run into the stackoverflow. This appears to be a fallout of a compensating bugfix done in GF for a related JDK issue.
Can you please try the following and let us know...
1. disable Security Manager back again
2. Go to "Configuration> Security> JACC Providers> default" under the admin console
3. change the Policy Provider class name to "com.sun.enterprise.security.provider.BasePolicyWrapper"
4. restart GF and deploy your RA again.
Thanks.
[Message sent by forum member 'kumarjayanti' (kumarjayanti)]
http://forums.java.net/jive/thread.jspa?messageID=275972