hebig.org/blog
Personal webnode of Haiko Hebig

"If you are having your Web site hosted on a shared server, chances are that other customers on the same server can have full access to your application and your data, due to [an] inadequate PHP engine configuration. [...] One part of the problem is in the default configuration of the session module." Basically, as the session files are normally owned by the server process, users having an account on the server can read session data from these files, learn the session ID, then forge the referer URL accordingly to fool session.referer_check and thus hijack a session.

In practice, things might be a bit more difficult of course and chances are your web hoster took some precautions. But if you have to run an important application on a shared server, perhaps have a look at Martin Sarsale's session function replacements he wrote in reply to a webkreator.com note on the subject.