note 9182 rejected and deleted from session_start by jmcastagnetto

This might be a dumb question but I'm not so sure about the security of a session. Say if a person come to a page that starts a session for him, say the session ID is "12345" (I know in real it shouldn't look like this). Then a 2nd person comes and is assigned session ID "67890". Both people are surfing the same page at the same time. Then if the second person use the GET method to type in the session ID of the 1st person, which is 12345, I assumed the 2nd person will see what the 1st person see and will be using the same session variables? Am I right? Please correct me if I am wrong. I dunno about session very well. Thanks. Joseph