Some frameworks (Spring, Tomcat itself) add servlet request attributes that cannot be used within an EL expression by default. An example would be
javax.serv
if you know the scope of the attribute, then you can fetch it from the appropriate implicit object, e.g.
${requestScope['javax.servlet.forward.context_path']}
I'm not sure if there's an implicit object that checks all scopes in the way that {xxx} does, though.
{xxx}