I was trying to make the event hierarchy clean while also not making my job to implement https://jira.springsource.org/browse/SEC-2135 harder. How about this two options.

SessionFixationProtectionEvent
SessionIdChangedEvent extends SessionFixationProtectionEvent
    - String getOldSessionId()
    - String getNewSessionId()
SessionMigrationEvent extends SessionIdChangedEvent
    - boolean sessionAttributesWereMigrated()

Like you said, the session ID could be changed for many reasons (but really? is the session ID ever changed anywhere else in Spring Security?), so this could actually mask that. If someone every wanted to change the session ID for some reason OTHER than session fixation, they would need a whole new event. OR, we could do this instead:

SessionIdChangedEvent
    - String getOldSessionId()
    - String getNewSessionId()
SessionFixationProtectionEvent extends SessionIdChangedEvent
SessionMigrationEvent extends SessionFixationProtectionEvent
    - boolean sessionAttributesWereMigrated()

I think maybe I like that one the best.