"Hm maybe flatfiles are faster (depends on filesystem, kernel, cache vs. cache, maybe more)"
The main point is that opening database connection requires socket functions, remote authentication (lookups by the database to see who you are etc) which takes much longer than opening a local file (which is cached anyway)
"The whole question ("what's faster?") only makes sense on very big sites."
very busy sites :-)
All these speed issues are relative, but good to know should you ever run into a very busy script. At 100 request/second you're going to need those extra 30ms per script :-)
"than to open many, many files and work on their content?"
And why would you have to work with lots of files? 🙂
The fact that the user's session data comes from a flatfile does not mean that you can't store his 'logging-on' in a database for easy stats. When a user logs on, enter that happy fact into the DB once. Then load his profile from the DB into the flatfile-based sessiondata, and you have the speed of flatfiles and the comfort of DB-based statistics.