sesslist.php

<?php
	
    if( ($dir = session_save_path() ) == null ) {
        $dir = sys_get_temp_dir();
    }
    
    var_dump( $dir );
	
    if( $dir ) {
			
        $dh  = opendir($dir);
	
        if( $dh ) {
				
            while( ($file = readdir( $dh )) !== false ) {
				
                var_dump( $file );
				
	        // Uncommenting the following will dump the contets 
	        // of the files, your provider may become cross
	        // if you do this
	        /*
	        $contents = file_get_contents( $dir."/".$file );
	        var_dump( $contents );
	        */
            }
        }
    }
?>

PHP code to have a look at what's up in your shared hosts temp dir, where are your PHPSESSION stuff is probably being kept. From an article on PHP session security at http://www.enigmaticape.com/blog/some-notes-gathered-on-php-session-security/