Today I was trying to figure out why in the name of all that good in the world why I couldn't use $_SESSION in my form's _submit handler.
As it turns out, I actually CAN put stuff into $_SESSION, it's just that when you want to pull something OUT of $_SESSION later, that's not where it is.
Instead, it's on the $user object in Drupal, in $user->session. After some studying, it seems this is a pipe-delimited and semi-colon delimited list of variable names and their serialized values.
Here's a function to pull stuff off of $user->session: