Session data is actually stored on the server, the default being "file" containers. This is actually a file that contains a serialized form of the variables you want to session_register(). Therefore, in theory, they can be as big as you want (within limitations of the file system on your particular server, for example, on Linux, this means 2 Gš.
The client only stores the session ID, not the data. This is handled either via a cookie (the default), or, if the client doesn't support cookies, by a URL propagation, using something like:
http://www.example.com?PHPSESSID=dfhsdkjhfsafw94579fd03