This is racy. Clients should be able to call create() without synchronization.