You may be using inappropriate cookie settings.
Firstly, if you want any illusion of security, don't pass session IDs in the URL. Enable session.use_only_cookies instead.
Are you having problems with session state being maintained between HTTP and HTTPS pages, or between HTTPS pages?
What domain and cookie domain are you using?
Can you reproduce this in your development environment?
Does your application run with error_reporting(E_ALL) and no errors, warnings or notices normally?
Mark