PHP session management

[Gavin Zuchlinski <gzuchlinski () pgsit org>]

Hi,
I noticed on a server how PHP creates files in /tmp in the form sess_XXXXXXXXX 
to store session information (of course only readable by the apache user), 
but "XXXXXXXXX" is the actual session ID. If a person has a local access to a 
system using PHP's session management, aren't they able to hijack any 
session? Am I a complete moron and am missing something?
And that aside, are there any other known problems with using PHP sessions 
(besides all the standard PHP security issues like variable access)?

-Gavin
http://libox.net/