is it possible that one of them could receive an improper return value because the method is looking at someone else's hashmap and returning it's count of null values?No. But that 'thread safety' comes entirely from how you use the method. It isn't a property of the method itself. The method itself is not thread-safe.
each of the million instances has it's own sandbox it's running in.Please stick to the standard terminology. 'Sandbox' already has a meaning in Java, and that isn't it. Each thread has its own stack; parameters and local variables are pushed onto the stack; ergo each thread's invocation of the method has its own parameters and local variables. If you can also ensure that each thread has its own hash map for passing to this method, then the totality of all this is thread safe. Not otherwise.