i am using timeout and checking myself for a valid session. but its true - it wont be deleted before timeout.
i havent found the solution - seems like php never cleans the garbage or more possible: i didnt read the whole manual?
let me know if you find something.