PHP versions 4.2.3 and lower have an undocumented feature bug that allows you to initialize a session variable in the global scope albeit register_globals is disabled. PHP 4.3.0 and later will warn you if this feature is used by enabling both session.bug_compat_42 and session.bug_compat_warn.