To add "time" a second time does not make the string more unique than with just once "time".

I agree, that adding time the second time really does not add a whole lot to the uniquness of the string. But what does it hurt?

The uniqeness of the id's must be achieved before feeding them through MD5.

Given that it is highly unlikely that two sessions will be created within the same apache child process and less than a second away from one another. Just doing $$ . time() would likely be sufficient. But then again, this is not my technique (see below for that).