I have not reviewed the PHP source code to confirm this, but it looks like when session.save_path is empty, PHP uses the value of sys_get_temp_dir() (which varies by user).
session.save_path
sys_get_temp_dir()