If an object is referenced by a local variable -- is it safe from concurrency issues?

No. The local variable only holds a pointer to an object; if other threads can also point to this object, then it needs to be made thread-safe.

See also How do I ensure that my servlet is thread-safe?