My guess is that the application may rely on the session expiring to log out idle users. Giving malicious clients the ability to extend their sessions (or even just use session cookies that they find lying around) has historically been the cause of quite a few vulnerabilities.