I'm using the <?=SID?> feature to automatically append the corresponding session ID to every link, so that no cookies are required to use the site.

A sample URL as visible on the browser?s address bar:
http://webtest/human_resources.phtml?SESSIONID=cca7f03abde2c33077df25999850d6dc

Now if I change the SESSIONID parameter to something really stupid PHP simply creates a file with exactly that name regardless if a session with that SESSIONID has never been created before by session_start():

http://webtest/human_resources.phtml?SESSIONID=stupidsessionid

creates the file "sessstupidsessionid" in the session directory.

Why?
This way someone could fill up the whole directory!