I guess it depends upon how you are defining "instance".
If it is separate app servers, no problem.
If it is the virtual instance, they are each configured for authentication separately.
If it is different sites in the same virtual instance, can't happen. Not that this is a problem as long as you permission things correctly. For example, for instance B that user can be authenticated but permissioned so they are not members of sites A, C and D. Ultimately, however, you are constrained that a user cannot have a duplicate email address per company, so there is no crossover for the users.
