Same grave bug here! But here it happens only when APC (3.0.19) is enabled. Can the OP confirm it happens only with APC as well?

I can reproduce the bug with or without APC installed/enabled.

Same problem here (Gentoo Linux PHP 5.2.10).
This bug seems some way related to this http://bugs.php.net/bug.php?id=48787

I'm having the same issue.  My problem is that I upgraded from PHP 5.2.9 to 5.2.11 and set up APC at the same time.  The  problem actually affected my custom session handler.  After finding this ticket I disabled APC and restarted apache, but the problem persists.

My code to recreate:
session.class.php
------------------
<?php
/**
 * These are our session handler functions
 */
class Session {
	/**
	 * Open a session
	 *
	 * @return bool true
	 */
	public static function ses_open() {
		return true;
	}

	/**
	 * Closes the session, after cleaning up.
	 *
	 * @return bool true
	 */
	public static function ses_close() {
		self::ses_clean(ini_get('session.gc_maxlifetime'));
		return true;
	}

	/**
	 * Reads the data from the session.
	 *
	 * @param string $session_id
	 * @return unknown
	 */
	public static function ses_read($session_id) {
		$db = db::get_instance();
		$q = "SELECT `data` FROM `sessions` WHERE `id`=".quote_smart($session_id);
		if (($r = $db->query($q)) && $r->num_rows > 0) {
			$i = $r->fetch_object();
			return $i->data;
		}
		return false;
	}

	/**
	 * Writes the session
	 *
	 * @param string $session_id
	 * @param string $data - serialized version of $_SESSION
	 * @return unknown
	 */
	public static function ses_write($session_id, $data) {
		/**
		 * I guess that our database connection is closed before this runs, but the
		 * static variable is not reset.  We run the destroy instance first, so that
		 * the singleton knows to create a new instance
		 */
		db::destroy_instance();
		$db = db::get_instance();
		$uid = (isset($_SESSION['uid']))? $_SESSION['uid']:'';
		$q = "REPLACE INTO `sessions` (`id`, `uid`, `ip`, `data`) VALUES (".quote_smart($session_id, $uid, $_SERVER['REMOTE_ADDR'], $data).')';
		return $db->query($q);
	}

	/**
	 * Destroys the session, and clears our 'remember me' cookie, so we can use this
	 * to log a user out
	 *
	 *
	 * @param string $session_id
	 * @return bool
	 */
	public static function ses_destroy($session_id) {
		$db = db::get_instance();
		$q = "DELETE FROM `sessions` WHERE `id`=".quote_smart($session_id);
		if(isset($_COOKIE['user'])){
			setcookie("ezd_user", '', time()-(60*60*24*7), '/', ''); //60*60*24*7=secs*mins*hrs*days=7days
		}
		return $db->query($q);
	}

	/**
	 * Cleans up (removes) old sessions
	 *
	 * @param int $max - How old "old" data is (in seconds)
	 * @return bool
	 */
	public static function ses_clean($max) {
		$db = db::get_instance();
		$q = "DELETE FROM `sessions` WHERE `access` < NOW() - INTERVAL {$max} SECOND";
		return $db->query($q);
	}
}


test.php
-----------
/**
 * Starts a session.  Since we need to do this in more than one place, this
 * function sets the session name and handler, then starts it.
 */
function start_session() {
    require_once('session.class.php');
    session_name('EZD_ID');
	/*
    session_set_save_handler(   array('Session','ses_open'),
                                array('Session','ses_close'),
                                array('Session','ses_read'),
                                array('Session','ses_write'),
                                array('Session','ses_destroy'),
                                array('Session','ses_clean'));
	*/
    session_start();
}

start_session();

Please try using this snapshot:

  http://snaps.php.net/php5.3-latest.tar.gz
 
For Windows:

  http://windows.php.net/snapshots/

No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".