Just looking at the session code I've noticed three things: the first two are minor code cleaning issues and the third may require a code change.

1. TWebContext.SessionStop has a Boolean param "ARaiseExceptionIfExpired" that is not used in the method.
   IMO this can be removed

2. TMVCEngine.GetCurrentSession has an Integer param "ASessionTimeout" hat is not used in the method.
   IMO this can be removed

3. TWebContext.SessionStop removes the session from the global session dictionary.
   In certain circumstances this (via the TDictionary notification process) this can call the destructor on the Context's TWebSession instance. However the private variable is now left dangling so the next time it is accessed it will cause an AV.
   This require some more work to provide a reproducible example