Hi
You are correct. Thanx for the report!
This side-effect of calling find() has not been understood until now.
Unfortunately, it may be necessary to change the API somehow to fix this
problem.
A new version of CGI::Session is just about to be released, to fix a
taint error message problem with Perl 5.10.0 (RT#48733).
I think we'll have to delay investigating your bug report until that
version is released, since I can't guess how long it is going to take to
solve the issue you've raised.