All I can find in the Tomcat 5.5 docs is:
Set to true if you want calls within this application to ServletContext.getContext() to successfully return a request dispatcher for other web applications running on this virtual host. Set to false (the default) in security conscious environments, to make getContext() always return null.
I've found some forum posts that comment that setting crossContext=true also enables sharing the session object between different web applications, but I'm not able to find any official docs stating this.
Is there a relation between Servlet.getContext() and the ability to share session state between different web applications?
What does the crossContext attribute really do in Tomcat?
From the javadoc ServletContext.getContext():
This method allows servlets to gain access to the context for various parts of the server, and as needed obtain RequestDispatcher objects from the context. The given path must be begin with "/", is interpreted relative to the server's document root and is matched against the context roots of other web applications hosted on this container.
So for instance if you want to include a page from a different webapp you need to set crossContext to true.