...
"If a singleton contains a nontransient object reference field, the contents of this field will be deserialized before the singletonâ�€�™s singletonâ��‚���„�s readResolve method is run. This allows a carefully crafted stream to 'steal' a reference to the originally deserialized singleton at the time the contents of the object reference field are deserialized" [Bloch 2008].
...