reaction to review of David Winslow:
1) By storing the configuration in the member configPropActual of PrintingServletWrappingController aren't we introducing a concurrency problem? What will happen if two requests come in simultaneously using different configuration files?

Don't know for sure (I'm not familiar with Spring and not that familiar with Servlets either).
But I simply removed the confiPropActual, as it is not necessary (the idea was a little speed up with a cache as no files need to be read).

2) This code also allows a remote user to create unlimited copies of the default configuration file by requesting nonexistent configurations. Shouldn't it only create the default configuration (from the servlet init parameters) and give an error if another configuration is requested that does not exist?

Yes, fixed by copying the default config only if it does not exist

3) Do we need to sanitize the configProp parameter to prevent remote users from creating files outside the configuration directory? As is, it seems that a remote user could use this to clobber shapefiles in the GeoServer data directory.

Also yes (tested):
The use of
qualifiedConfigFilename = new File(configProp).getName()
works much better.
Now just files out of the printing directory can be used!