PHP 4.0 Bug #7044: Session file created when using bogus SESSIONID

From: kimmel@tricos.com Operating system: Windows NT 4 Workstation PHP version: 4.0.2 PHP Bug Type: *Session related Bug description: Session file created when using bogus SESSIONID I'm using the <?=SID?> feature to automatically append the corresponding session ID to every link, so that no cookies are required to use the site. A sample URL as visible on the browser´s address bar: http://webtest/human_resources.phtml?SESSIONID=cca7f03abde2c33077df25999850d6dc Now if I change the SESSIONID parameter to something really stupid PHP simply creates a file with exactly that name regardless if a session with that SESSIONID has never been created before by session_start(): http://webtest/human_resources.phtml?SESSIONID=stupidsessionid creates the file "sessstupidsessionid" in the session directory. Why? This way someone could fill up the whole directory!