The session files have not yet led to a failure for me, but I have just wondered about countless session files in the /tmp directory.
PHP also has a built-in garbage collector, but this is explicitly deactivated in php.ini with session.gc_probability = 0. In combination with a missing cronjob...