On windows (not checked on other environments), the quickstart tutorial FORM code
$this->addElement('hash', 'csrf', array(
'ignore' => true,
creates a session file in the directory set up in the "session.save_path" variable of php.ini (something like "c:\wamp\tmp")
But if you put the same same code in a module, it tries to create the session file in the directory APPLICATION_PATH "/../data/session" which doesn't exist by default so an exception is raised.
If the solution is to create this "date/session" directory, it doesn't explain why a module doesn't use the one in the "session.save_path" variable of php.ini.
You can use the provided
Zend_application_Resource_Session to set up your
resources.session.save_path = APPLICATION_PATH "/../data/session"
You can still set it to
/tmp if you want.