I could see advantages for mass surveillance intercepting PHP sessions to track that individual user's exact movements. Although, I would see more advantage to using the web browser's cookie(s) for targeted surveillance.
This said I could foresee using PHP session data to reverse engineer how the php.ini file in configured. Working from there, the better I understand php.ini configuration the closer I am to finding a vulnerability with the PHP server. PHP: Sessions - Manual. PHP Garbage collector.
Are the contents of these session files ever used forensically
I have not seen scenarios for digital forensics of PHP sessions. However, each session has a unique ID which could be used to perform targeted surveillance of an individual. However, this will only work if enough logs are stored for the session ID to be matched with the session data, and ordinarily, servers do not handle full take (metadata and content) interception. Despite not directly answering your question Command-Line Forensics of hacked PHP.net may give some insight.
Cookie Examiner forensics analysis. This should outline the type of metadata we expect for performing forensic data analysis.