At least on Mac OS X 10.5.6 running PHP 5.2.6 installed via Macports, the default session.save_path shows up as "". After some poking around, I discovered that that means: /private/var/tmp (not /private/tmp).
Session support is enabled in PHP by default. If you would not like to build your PHP with session support, you should specify the --disable-session option to configure. To use shared memory allocation (mm) for session storage configure PHP --with-mm[=DIR] .
The Windows version of PHP has built-in support for this extension. You do not need to load any additional extensions in order to use these functions.
By default, all data related to a particular session will be stored in a file in the directory specified by the session.save_path INI option. A file for each session (regardless of if any data is associated with that session) will be created. This is due to the fact that a session is opened (a file is created) but no data is even written to that file. Note that this behavior is a side-effect of the limitations of working with the file system and it is possible that a custom session handler (such as one which uses a database) does not keep track of sessions which store no data.