@smalyshev 

SessionUpdateTimestampHandlerInterface would have only

 - createSid()
 - validateSid()
 - updateTimestamp()

I'm thinking code like

class MySessionHandler implements SessionUpdateTimestampHandlerInterface
{
    // implement interfaces here
}

$handler = new MySessionHandler();
session_set_save_handler($handler, true);
session_start();

Current code registers object's open, close, read, write, destroy, gc methods as handler, regardless of implemented interface. New code may detect SessionUpdateTimestampHandlerInterface. 

I'm having trouble to detect proper updateTimestamp() is registered or not. With this, I can prevent to register bogus PHP_METHOD(), i.e. updateTimestamp(), validateSid(). If you are interested in what's the trouble is, I can explain. It would be long explanation...

I think create_sid() method has the same issue, but nobody noticed it.