The most immediately obvious mechanism would be that the class' DESTROY does it on the way out.

No, it's not true. It would be done as Fletch says. Seems like it was planned at the synopsis writing time, but hasn't been implemented. But let's see if there's some magic.

A private copy in my $PERL5LIB directory, patched as follows...

--- /usr/lib/perl5/site_perl/5.8.8/MojoX/Session.pm 
+++ /home/shmem/comp/perl/lib/MojoX/Session.pm
@@ -81,7 +81,7 @@
 
 sub flush {
     my $self = shift;
-
+warn "LAST ORDERS. FASTEN SEAT BELTS...\n";
     return unless $self->sid && !$self->_is_flushed;
 
     if ($self->is_expired && $self->_is_stored) {
[download]

... used within this script...

use MojoX::Session;
my $session = MojoX::Session->new;
$session->create();
$session->data('foo' => 'bar'); 
warn $session->data('foo'),$/;
undef $session;
warn "did we land yet?\n";

my $session = MojoX::Session->new;
$session->create();
$session->data('bar' => 'baz'); 
print $session->data('bar'),$/;
$session->flush();
warn "end-of that.\n"
[download]

... produces...

bar
did we land yet?
baz
LAST ORDERS. FASTEN SEAT BELTS...
end-of that.
[download]

... which shows that just undefining $session doesn't call flush(). How could it? there's no DESTROY method.