objecter: fix session locking, use after frees (#9706)