I'm not 100% sure that it's a bug, but I'd like get some feedback.
If developer is calling $session->getMetadataBag()->getLastUsed(), before session is started (for whatever reason) it will return null and following scenario will always be true, even if it wasn't intended

$maxIdleTime = 1000;
if (time() - $session->getMetadataBag()->getLastUsed() > $maxIdleTime) {
    $session->invalidate();
    throw new SessionExpired(); // redirect to expired session page
}

Question:
Should getMetadataBag insure that session is started? If yes, should it start session by itself, or throw exception that session is not started.