SessionStore's definition of cleanStaleSessions iterates over self.items(), which loads all the sessions into memory. This effectively eliminates the purpose of SessionFileStore.
This was repeatedly crashing a Webware process running SessionDynamicStore during periods of peak traffic, when abnormally high numbers of sessions were created.
Changing the loop in SessionStore to iterate over the keys, rather than the items, fixes the problem. A patch is attached.