This is probably not directly related to the problem you're experiencing, but for what it's worth, the Apache::Session documentation says:

When Session encounters an error, it calls die().  You will probably w
+ant to wrap your session logic in an eval block to trap these errors.
[download]

He's not kidding. If you supply the TIEHASH method with either a funky session ID, or a session ID for which there is no session in the store, Session dies. Do something like this to handle potential exceptions:

eval {
 tie %session, 'Apache::Session::File', $session_cookie,
    {
        Directory       => "../data/sessions",
        LockDirectory   => "../data/sessions"
    };
};
if ($@) {
 # since the first attempt failed, supply the
 # undefined value as the session ID argument
 # so that Session will generate a new session
 tie %session, 'Apache::Session::File', undef,
    {
        Directory       => "../data/sessions",
        LockDirectory   => "../data/sessions"
    }
}
[download]

Also, since you're a smart Perl developer and you're using taint mode, you'll want to untaint the session ID before passing it to Apache::Session. The session ID is inserted in session filenames and lock filenames, and Perl will raise an exception if you don't untaint it.

Update:

For what it's worth, it doesn't look like Apache::Session has even been tested on Win32. test report.

If you're having a problem with Fcntl, you might look into Apache::Session::Flex, which should allow you to use your own file locking code. You may be able to use File::FlockDir to do most of the work.