I have php scripts containing this exact code:

<?php
 
    session_start();
    echo session_name()." == ".session_id()."<br>\n";
 
?>
<H3>buggy.php</H3>
[<a href="buggy.php">SELF</a>] 

If the filename is "buggy.php", the first session_start() is lost, but the second session_start() is retained (i.e. a sess_* file is created in /tmp on the first call, then another is created in /tmp on the second call, and this second file is used there on).

If the filename is "buggy1.php", the first session_start() is retained---like it's supposed to be.

If the filename is "buggy2.php", then the behavior is similiar to that of "buggy.php". Except _sometimes_ the first and second session_start() are lost, and the third is retained. I think this is dependent upon the state of sess_* files in /tmp.. puzzling.

If the filenmae is "1234567890.php", things work normally, as in the case of the filename "buggy1.php".

Another note, refreshing a page starts a new session if there is no PHPSESSID defined in the URL. If PHPSESSID is defined in the URL, then no new session is created when refreshing a page.

I compiled with --enable-trans-sid and --enable-track-vars, I have cookies turned off in php.ini, and referral_check turned on.