Including the user-agent in the session provides some rudimentary protection against session hijacking. This means if the attacker somehow got access to the session cookie he cannot just simply use the cookie in some random browser but must use the same browser, version, subversion etc as the original user - or at least know what the original user-agent value was and make the own browser use this.
If the session id is stolen by sniffing (unprotected) traffic then the user-agent is easily available too within the sniffed data so it can be perfectly faked. If the session cookie is instead stolen by XSS or similar (i.e. cookie was not set to httponly) the exact user-agent is not immediately known but can be retrieved with some tricks too (see comment from @multithr3at3d on this answer).
Thus, including the user-agent into the session cookie will not provide relevant additional protection if your site is HTTPS only (or at least the cookie, i.e. has the
secure flag) and the cookie cannot read by XSS (i.e.
httponly flag), which are both things you should do anyway.