Description:
------------
Hi,

we are using MySQL for storing sessions of logged-in users and we've 
encountered a problem with few duplicated sessions ID when inserting new one 
during last year. We've looked into PHP source code where we found a possible 
bug.

Currently we are using PHP 5.4.29, so we investigated source code for this 
version at first (file ext/session/session.c, function 
php_session_initialize). We've found out that after the new session ID is 
created, it is not checked if it exists in session storage. Then this new 
session ID is used to read data from session storage. This could lead to 
reading data of another user if duplicated session ID was generated.

The possibility of ID collision is small, but could happen and for our case 
already happened. We currently have ~500k active sessions with ~30k new 
sessions per day.

Also we looked into source code of PHP 5.5.15. The problem persists int this 
version too. But now there is possible workaround. SessionHandler and 
SessionHandlerInterface have a new method for creating own session ID, but it 
is not mentioned in documentation. This method was not build to handle this 
problem, but can be used for it.

Possible solution:
Create method in PHP like "testAndCreate" in SessionHandler and 
SessionHandlerInterface which should check if session ID exists in session 
storage and if not create it. Depending on the result PHP should generate new 
ID or continue. Also mention this in documentation.