Recently I was musing on the problem and realized that I cannot think of a plausible scenario for a session fixation attack against a PHP application running with default settings.
session.use_only_cookies's default value is
session.cookie_httponly to be
Off and also a working XSS. The only other way I can think of is a script on the site but if we already have a shell, why bother with sessions?
I am not arguing against the use of
session_regenerate_id() but an impressive example demonstrating why it's an absolute necessity always helps.