Originally reported in debian bug #303639 I tested a different scenario to the reporer on MOODLE_19_STABLE which also doesn't work:

1/ Set sessiontimeout to 5mins
2/ Logout and log back in again and click around a few pages
3/ Leave the page for 10mins
4/ Attempt to follow a new link on site:

Expected result:
User session times out and is force to log back in again.

Actual result:
User is kept logged in and session is sitll active