That's the role of the garbage collector. When a PHP script runs, PHP also looks through the session data directory for session files that haven't been modified in a long time (indicating that the client has ended the session at their end). These garbage files are deleted.
It would be excessively inefficient to do this on every script invocation, however, so (by default) it's only done 1% of the time at random.
session_destroy() will also delete the session data file.