...
"If a singleton contains a nontransient object reference field, the contents of this field will be deserialized before the singletonâ�����������������€š�š�š�š�š�š�š�š������������������€š�š�š�š�š�š�š�z�s singletonâ������������������‚�š�š�š�š�š�š�š�š�������������������‚�š�š�š�š�š�š�š�z�s readResolve
method is run. This allows a carefully crafted stream to 'steal' a reference to the originally deserialized singleton at the time the contents of the object reference field are deserialized" [Bloch 2008].
...