(2.)
This is normal; PHP doesn't delete old session files the instant they expire.
For one thing, PHP isn't necessarily running at that particular moment; it only runs in response to a request from a client.
For another, it would be horribly expensive in time and resources for PHP to go looking through the tmp directory for old session files every single time it runs. So instead it only cleans up occasionally. A randomly-selected 1% (by default) of the calls to session_start() to be precise. The default value for this garbage collection probability can also be adjusted in php.ini.
But as sarahk says, that shouldn't be a problem - as soon as the browser is shut down it is supposed to forget its session ID - so the browser can't supply the ID to the server when it makes a request, so the server gives it a new one instead.
