Yes, that will certainly cause a leak. Maybe you should reconsider the way you're structuring your objects. Is the session really an attribute of the community, or is an attribute of the current request context? You might try making a global class method that just returns the current session which you can call from anywhere. Something like
would do the trick. Then keep the session in a global (or $r->pnotes under mod_perl) that is only read and written to by that method.