Why is Firesheep unable to session hijack when a user is using SSL?
The web browser and the web server establish an encrypted connection before any HTTP communication, so when the session data is exchanged it is within the encrypted tunnel and is protected from man-in-the-middle attacks or eavesdropping.
For details, check out the SSL sequence diagram from: http://www.eventhelix.com/RealtimeMantra/Networking/
Technically Firesheep could session hijack SSL connections, but then you would likely get a warning from the browser about establishing an untrusted connection, for example:
It needs to read the content of the HTTP transactions between the victim's computer and the remote server. SSL features point-to-point encryption using a key that's negotiated by the two systems, so a third system passively eavesdropping cannot read the content.
Note that it is possible to inspect SSL content by interposing the attacking system between the two parties. This is called man-in-the-middle, and is used by corporate content filters so that they can filter both HTTP and HTTPS communication.