It's both a performance and scalability issue but perhaps wasn't specific enough simply to say "no databases".
Regarding scalability, essentially you don't want to store high demand but disposable user session state data (which in a desktop app, for example, you'd keep in memory) in the _same_ database as the real application data, otherwise you can't scale the layers seperately.
Regarding performance, it's a good idea to keep session data as "close" to the script that needs. You might use a seperate, _local_ database (PHP5 has SQLite built in which, interestingly, is capable of storing data in memory as well as a file) but, arguably, you want the path to session store to be as clear as possible (certainly if it needs a network call, that's bad news).
Also from an maintence point of view, the less complexity you add, the better your chances when things go wrong and the lower your operating costs.
As you scale, you can turn to stuff like IBM's Parallel Linux File System for handling session data.