In order to destroy the variables associated with a session in 4.0.6 and below, you should use the special function session_unregister, for example:

<?php
session_start();
session_unregister($userName, "userName");
session_destroy();
unset($userName);
...
?>