I regularly used to see my sessionID pop into the URL when using Internet Explorer - I don't think I've ever seen it with Firefox, whether that's a result of changes at Renderosity or in the browser I couldn't guess. The problem isn't exclusive to Bondware - I get the sid=##### added to my URL in Firefox anytime I move a thread at the DAZ PHP forums, and I think we've had at least one case (a long time ago) of a store link being posted with some kind of session data - you need to check your links whereever you are.