Google’s JohnMu warned one webmaster over the New Years break in a Google Webmaster Help thread to never ever list URLs with session IDs in the Sitemap XML file.
John said:
To most of us, this is obvious. But sometimes the obvious needs to be said.
Sending Google duplicate URLs for the same landing page is asking for trouble. Why hand Google duplicate content on a silver plater? That is what you are doing when you are listing these URLs in a Sitemap file. If you have duplicate content on your site, and you don’t block it from Google, then Google has a better shot of figuring it out based on crawling your site versus seeing it in a Sitemap file.
No duplicate URLs or session ID based URLs should be listed in a Sitemap file.
Forum discussion at Google Webmaster Help.