It looks like the issue has been introduced because of the following wakeup magic method called when the session data is unserialized in the file: libraries/joomla/user/user.php

/**
 * Method to recover the full object on unserialize.
 *
 * @return  void
 *
 * @since   3.6.0
 */
public function __wakeup()
{
    // Initialise some variables
    $this->userHelper = new JUserWrapperHelper;
    $this->_params    = new Registry;

    // Load the user if it exists
    if (!empty($this->id))
    {
        $this->load($this->id);
    }
    else
    {
        // Initialise
        $this->id = 0;
        $this->sendEmail = 0;
        $this->aid = 0;
        $this->guest = 1;
    }
}

It's a needed change. There are security issues with how the user data was persisted to the session in previous releases. Not sure what can be done with the potential B/C arguments but this isn't something that can/should be easily reverted.

Thanks Michael, but take care the this is a potential issue.
If an admin would delete a user record currently logged in, he will face this issue. Joomla! will fail to load and he would get the error: Error displaying the error page: Application Instantiation Error: Application Instantiation Error
that's not properly acceptable.

I found that the error is thrown because in the file /libraries/joomla/log/logger/messagequeue.php
the
JFactory::getApplication()->enqueueMessage($entry->message, 'warning');
requires an empty application object with missing $id parameter.

Far better than a security issue

When a user is deleted unless you've disabled the Joomla User plugin their sessions should be immediately deleted as well.

I'm not going to detail the possible security issues with this here, but the manner in which the user data was previously serialized is indeed one that needed addressing.

The "Application Instantiation Error" is happening because the line you pointed out is trying to reference the application object before it has been set to JFactory::$application; since sessions are started in the application constructor instead of lazy started this creates an issue in an error condition on session start. It probably needs cleaning up now, but a variation of staging...mbabker:refactor-session-metadata-coupling would help massively in dealing with session startup and potential issues in it causing a fatal error.

As always i had to change the code of my extension to follow Joomla changes, that as always are not documented and have impact on all extensions that till now were aware that Joomla picked up user data from the session serialized field, instead now they are picked up always by the #__users table.

Taken you a long time to notice

Closed

upodate 3.6.1 same sessions errors...

@RaimisErvit commenting on a closed issue will not be seen