4. has been fixed by [HttpFoundation] smaller fixes for PdoSessionHandler #11009 and will be in next patch release
   What do you mean by 3.?

Thanks for no. 4.
Regarding no. 3, queries are written like:
REPLACE INTO $this->table ($this->idCol, $this->dataCol, $this->timeCol)....
where as it would be good to be like:
sprintf(
'REPLACE INTO %s (%s, %s, %s) VALUES (:session_id, :session_data, :session_time)',
$this->table,
$this->idCol,
$this->dataCol,
$this->timeCol
);

What's the difference?

I think sprintf() is used in symfony as standard. Anyway, it is not blocking. :)

The problem is that different DBMS use different characters for quoting identifiers. And it's not recommended to use to use reserved words anyway. Neither in doctrine. So not sure if worth implementing. See https://github.com/doctrine/dbal/blob/master/lib/Doctrine/DBAL/Platforms/AbstractPlatform.php#L529

I will try to work on it for enhancements and send you newer version hopefully.

I already looked into fixing it as part of #10931

Closing as @Tobion fixed most "fixable" problems.