I can confirm the issue. The following test script is sufficient
to reproduce it:

    <?php
    $cookieData = &$_COOKIE;
    session_start();
    var_dump($_SESSION);
    $_SESSION['foo'] = 'bar';

Apparently, the by-ref assignment causes a new session to be
created on each request.

@michael: The condition of the outermost if statement in your test
script is always FALSE, because a variable can't be isset() and
is_null().

Ya, that was just me trying to reproduce what our internal code actually does as close as possible (the isset is part of our input API and the is_null check in the session startup).  Either way, glad to see I haven't completely lost it :-)