Once again, in more details:
ext/session writes its data on shutdown (if one doesn't call session_write_close() explicitly, but this is not the case).
When the extension tries to write the data, it suddenly discovers that the path is wrong and fails, producing the error. This error is caught and converted to an exception, which is thrown by the error handler. But at this point the engine is partly down and there is no active script (its execution has finished and the engine is shutting down), hence there is nobody to catch the exception and there is no stack frame (that's exactly what the message says).

This is similar to following case:
<?php
class foo {
  function __destruct() {
    thrown new Exception("boo");
  }
}

$foo = new Foo;

/* uncomment the line below and the object will be destroyed when there is an active scope.
though it does not change the fact that an uncaught exception results in a fatal error.
 */
//unset($foo);
?>

You seem to be expecting the exception to vanish somewhere, but that's clearly wrong.

Tony -- thanks for the explanation. I have one question, though: from what you say, it sounds like the error is not being raised until script  shutdown -- i.e., only when the script is attempting to write the session. However, that doesn't seem to be the case. If I modify the reproduce script to add an echo statement after the try/catch block, or even in the try block *after* the call to session_start, that echo is never reached.

From observing that behaviour, it *appears* that the exception is being thrown before script shutdown. What is the explanation behind that behaviour?

Never mind -- the statements *are* being echoed -- I just didn't see them as they were in the same line as the exception message.

Thanks for the explanations, Tony.

>If I modify the reproduce script to add an echo statement after the 
>try/catch block 

I can see all the echos after the try/catch block.

>or even in the try block *after* the call to
>session_start, that echo is never reached.

No wonder, there is an exception in session_start() either.

>From observing that behaviour, it *appears* that the exception is
>being thrown before script shutdown. 

1) Error caught and thrown as exception: session_start():
open(/var/log/sess_3e97dad0fe4ce6f285e97593471f2c88, O_RDWR) failed:
Permission denied (13)
2) Fatal error: Exception thrown without a stack frame in Unknown on line 0

1) and 2) are two different exceptions.