It is debatable whether the function should destroy the old session.  The current behaviour is useful under a number of circumstances. Auto-destruction could be added as a new feature though.

 -> Feature/Change request.

You're right, in my own case i use this function to do a per-page session (following OWASP's "Guide to Build Secure Web Applications" or something like that), so what i'm doing is to refresh the id every time a user do a request, but without lost the "statefulness". So, if you think this need to be supported by the php sessions code, was an honor help you, if not... i already do a little patch to support it on my own server.

pablo.

I would definitely be for auto-destruction of the old session file as I have come upon this problem as well and I have made a similar enhancement suggestion under bug: http://bugs.php.net/bug.php?id=32631

Don't know if this works on PHP 4, but this is what I did to get session_regenerate_id to delete the old session file in PHP 5.  Replace the session_regenerate_id function in session.c with this function I modded:

PHP_FUNCTION(session_regenerate_id)
{
        char *oldID = empty_string;
        if (PS(session_status) == php_session_active) {
                if (PS(id)) {
                        oldID = PS(id); //save old id
                        efree(PS(id));
                }

                PS(id) = PS(mod)->s_create_sid(&PS(mod_data), NULL TSRMLS_CC);

                php_session_reset_id(TSRMLS_C);

                if (oldID != empty_string) PS(mod)->s_destroy(&PS(mod_data), oldID TSRMLS_CC); //delete old session file

                RETURN_TRUE;
        }
        RETURN_FALSE;
}

Thanks, Ilia, for implementing this option in PHP 5.1. I know many people will be happy about this.  :-)

As last comment says, this feature was added to PHP 5.1.