Can you rely on %session being called 'session'? If so, why not just grep it out of your code? It seems like grepping for $session{x} ought to get a short list of suspect regions of code.

You should be able to do a more sophisticated static analysis of the code with PPI. I haven't ever needed to do this sort of thing, so I can't give anything more than a pointer to the module.