title: How does `this` reference to an outer class escape through publishing inner class instance?
body: <p>This was asked slightly differently earlier <a href="https://stackoverflow.com/questions/17045622/am-i-letting-the-this-reference-escape-inner-class-in-constructor-instantiat">but asking for a yes/no answer</a> but I'm looking for the explanation that's missing from the book (Java Concurrency in Practice), of how this apparent big mistake would be exploited maliciously or accidentally. </p>
  
  <blockquote>
    <p>A final mechanism by which an object or its internal state can be
    published is to publish an inner class instance, as shown in
    ThisEscape in Listing 3.7. When ThisEscape publishes the
    EventListener, it implicitly publishes the enclosing ThisEscape
    instance as well, because <em>inner class instances contain a hidden
    reference to the enclosing instance</em>.</p>
    
    <p>Listing 3.7. Implicitly Allowing the this Reference to Escape. Don't
    do this.</p>
  </blockquote>
  
  <pre><code>public class ThisEscape {
      public ThisEscape(EventSource source) {
          source.registerListener(
              new EventListener() {
                  public void onEvent(Event e) {
                      doSomething(e);
                  }
              });
      }
  }
  </code></pre>
  
  <blockquote>
    <p>3.2.1. Safe Construction Practices</p>
    
    <p>ThisEscape illustrates an important special case of escape—when the
    this references escapes during construction. When the inner
    EventListener instance is published, so is the enclosing ThisEscape
    instance. But an object is in a predictable, consistent state only
    after its constructor returns, so publishing an object from within its
    constructor can publish an incompletely constructed object. This is
    true even if the publication is the last statement in the constructor.
    If the this reference escapes during construction, the object is
    considered not properly constructed.[8]</p>
    
    <p>[8] More specifically, the this reference should not escape from the
    thread until after the constructor returns. The this reference can be
    stored somewhere by the constructor so long as it is not used by
    another thread until after construction. SafeListener in Listing 3.8
    uses this technique.</p>
    
    <p>Do not allow the this reference to escape during construction.</p>
  </blockquote>
  
  <p><strong>How would someone code against this to get to the OuterClass before it's finished constructing? What is the <code>hidden inner class reference</code> mentioned in italics in the first paragraph?</strong> </p>