>It is one thing to be able to create a nice web application that can handle 10,000 concurrent users. Its a completely different thing to build one that
can handle 5,000,000 concurrent users.
First of all, your numbers are off. But nevermind. The trick isn't to increase complexity, though to a point, that might work. But complexity doesn't scale. At some point (long before it actually pays off with EJBs) you hit a wall of complexity that can not be maintained. In _any_ system, this happens long before 5 million concurrent users.
The solution is not to increase the number of concurrent sessions available, but to reduce the number needed. A stateless session protocol is the answer. That's why the internet is so popular.
An EJB-style solution, no matter what, fails to do this. You are increasing the number of sessions, and trying to use some generic passivity algorithm to keep them down, in the hope that someday hardware will catch up. Let the users help you decide how long their session is.
It turns out the reinitializing the session is less expensive than maintaining it.