When format-dateTime() (or -date() or -time()) is used with the language parameter set or defaulted to "en", Saxon uses a default instance of the Numberer class which is held in static data - that is, it is shared across all threads in the virtual machine, even across different Saxon Configurations. The Numberer however is not stateless - it holds the value of the country parameter. So if the country parameter is set to different values in different calls, the result is not thread-safe.
This problem was discovered during rewriting of the code for Saxon 9.2. Since no-one has actually encountered the problem on 9.1 (or earlier releases), and since it is probably unusual to use the country parameter in such a way as to trigger the problem, no fix is being produced on the Saxon 9.1 branch for the time being.