private List<SessionStateItemCollection> GetAllSessions()

{
            List<SessionStateItemCollection> sessionsList = new List<SessionStateItemCollection>();
            object obj = typeof(HttpRuntime).GetProperty("CacheInternal", BindingFlags.NonPublic |
          BindingFlags.Static).GetValue(null, null);

            object[] obj2 = (object[])obj.GetType().GetField("_caches", BindingFlags.NonPublic |
                BindingFlags.Instance).GetValue(obj);

            for (int i = 0; i < obj2.Length; i++)
            {

                System.Collections.Hashtable c2 = (Hashtable)obj2[i].GetType().GetField("_entries", BindingFlags.NonPublic |
                    BindingFlags.Instance).GetValue(obj2[i]);

                Hashtable c2b =  (Hashtable)c2.Clone(); // work on clone to prevent exception of collection was modified in the middle of iteration

                foreach (DictionaryEntry entry in c2b)
                {

                    object o1 = entry.Value.GetType().GetProperty("Value", BindingFlags.NonPublic |
                        BindingFlags.Instance).GetValue(entry.Value, null);

                    if (o1.GetType().ToString() == "System.Web.SessionState.InProcSessionState")
                    {

                        SessionStateItemCollection sess = (SessionStateItemCollection)o1.GetType().GetField
                            ("_sessionItems", BindingFlags.NonPublic | BindingFlags.Instance).GetValue(o1);

                        if (sess != null)
                        {
                            sessionsList.Add(sess);
                        }

                    }

                }

            }
            return sessionsList;
        }

source:

http://weblogs.asp.net/imranbaloch/reading-all-users-session