session_save_path() just returns the value of session.save_path, which is empty by default. The default storage location for the file session-handler is the system temporary directory (take a look at
PHP_FUNCTION(session_save_path) in
session.c and
PS_OPEN_FUNC(files) in
mod_files.c). session.save_path is mostly (only?) significant for the file session-handler. As that's what the x10 servers use by default (the only other registered session handler is the user handler), "/tmp" is where session data is stored.