Fix #79091: heap use-after-free in session_create_id()

If the `new_id` is released, we must not use it again.