To clear up any uncertainty, I think there are two questions being asked:
- Link to be disavowed: Do I disavow both the www and non-www versions of a bad link?
- Site you own: Which site in webmaster tools do I upload the disavow list to - www or non-www?
The link to be disavowed is an easy answer because in most cases if you want a link disavowed, you probably don't want a link from that domain (because its suspect, de-indexed, etc.). Therefore you can simply blanket it with domain:badwebsite.com. This will be sure to get any link from this site to yours, regardless of the subdomain (i.e. www.badwebsite.com, ww2.badwebsite.com, forum.badwebsite.com, etc.)
Answer #2 isn't quite as easy. The safest (and arguably proper) way is to link mine both the www and non-www versions of your website and treat each as a separate site (as Google does). Even if you are using 301 redirects or canonicals I still recommend this method. In many cases, one version will have a much smaller backlink volume. In any case, pick out the bad links and try to get them removed by emailing the website. Once the attempt has been made, Compile the remaining backlinks (still in separate lists for www and non-www), and upload them to their respective disavow tool areas.