[NeilFawcett]

In VBulletin there is a variable for the session id, and it's also held in a cookie. Given this you can then read the session file. This will tell you the user id and when the last activity was.

My issue of course is I want to validate in a another script (run directly from VBulletin) if the user is a valid user etc. I'll probably try something like this:-
a) Get the session id.
b) Read the session table for that id.
c) If the session is within 30 minutes old I'll assume we have a valid user. I may also check say the first two elements of the IP address as well, just to be super sure (also held on the session record I believe).
d) Given we have a valid user, I'll create my own session record in my application and cycle round that.

So the first time into my program where I don't have a session ID, I will validate the user has come from VBulletin by using the session ID, and pick up their user ID and username accordingly. Once done I'll create and use my own purpose written session file and live of that...