sessions are managed in the database. when a user login, or just browse the forum, it is tracked action by action in the sessions system... even without cookies... when someone have the cookies inactive, the session id is kept in the url... so the id is compared with the data in the database, keeping track of the active user.

there is no $_SESSION because vBulletin is not using the default PHP session management, it has its own session manager... you have to call $vbulletin->session to make the same, but also have to load the vBulletin API to make it work...