Microsoft state a limit of about 60. Here explains more.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/webapp/iis/appisoa.mspx
"
Number of Application Pools That Can Be Configured
In the default configuration, using Network_Service as the application pool identity, you can create a large number of application pools without any difficulty. When you specify an identity for an application pool, it is given a set of resources, including a non-visible desktop. Interactive processes use desktops for dispatching events or messages, such as a mouse click, to Windows applications. In this context, only a few desktops are ever required by an application. For server applications, such as IIS, there is no interactive user; IIS and other COM applications running in a Single Threaded Apartment (STA) use the Windows message pump in a desktop to marshal data to COM components created within the process, and desktops are created even if the application uses no COM components. Microsoft tests show that when configuring more than 60 application pools with unique identities, a shared desktop should be used. This may be configured by setting the registry key HKLM\System\CurrentControlSet\Services\W3SVC\Parameters\UseSharedWPDesktop to 1. When this setting is enabled, application pools share a common desktop, thereby increasing scalability"
And in related article read David Wang blog on this.
http://blogs.msdn.com/david.wang/archive/2006/01/25/Security_considerations_of_UseSharedWPDesktop_on_IIS6.aspx
and here is some more techy details on the heaps including 32 and 64 bit sizes
http://blogs.msdn.com/ntdebugging/archive/2007/07/05/desktop-heap-part-2.aspx