Safe advice :
To avoid OOME in organization deploying CAST solution, not in a 24x7 mode, I would recommend to shut down Tomcat every night, and relaunch a fresh instance. So any memory leak become harmless, unless you have 500 heavy users.
This can be automated very easily.
Source : http://www.newwitness.com/knowledgebase/nwm_knowledgebase7.html
See also: http://javahowto.blogspot.com/2006/06/6-common-errors-in-setting-java-heap.html