It is the job of the handler to validate session IDs. the default file handler uses this whitelist:

    for (p = key; (c = *p); p++) {
       /* valid characters are a..z,A..Z,0..9 */
       if (!((c >= 'a' && c <= 'z')
               || (c >= 'A' && c <= 'Z')
               || (c >= '0' && c <= '9')
               || c == ','
               || c == '-')) {
           ret = FAILURE;
           break;
       }
  }

See http://lxr.php.net/xref/PHP_TRUNK/ext/session/session.c#php_session_valid_key

Thanks.
Is it possible to add this to the PHP Validate filters? 
That way a whole lot of PHP programmers (and noobs) won't have to reinvent the 
validation wheel, if they perform any validating at all.

I'm busy making a stricter validation filter that also takes into account the 
values of session.hash_function and session.hash_bits_per_character.

It is an interoperability feature that the session functionality is open. You can use a custom save-handler and serialization handler (like wddx) to share session data with non-PHP systems. Enforcing stricter checks might limit this interoperability, especially as a general check must be very restrictive.

An option might be to have the general check optional, but then we still have to do double checking in the default handlers in order to be always secure.