Since encryption keys are session-based in WPA2 enterprise, if person A obtains person B's credentials, will person B's encryption key still be safe? Is there any way person A could use person B's credentials to find the encryption key for a given session?
Basically, it is 802.1x. Key derivation is complicated. There is a high-level explanation here: http://www.tldp.org/HOWTO/8021X-HOWTO/intro.html
To answer your question simply, the key (actually there are several keys) is agreed upon by the AP and client based on another key issued by the authenticating RADIUS server. All of these keys are (ephemeral) session keys, with the exception of the group transient key, which is shared between clients (for multicast and broadcast) but periodically changed.
Simply knowing credentials will not cause you to arrive at the same set of keys as another user of the same credentials, or even the same set of keys you had the last time you authenticated. Any credentials at all will get you the group transient key, but unicast traffic remains secure.
As with all such things, there is an attack. To render that traffic insecure, an attacker could set up a rogue AP which acts as a gateway, allowing the target to authenticate to it and in turn authenticating with its credentials to the network. This is an active MitM, though, not a passive disclosure like you were worried about.