This week's book giveaway is in the OCMJEA forum. We're giving away four copies of OCM Java EE 6 Enterprise Architect Exam Guide and have Paul Allen & Joseph Bambara on-line! See this thread for details.
A session is not really a placeholder. It doesn't have a size. When you think of "putting an object in session" what you're really doing is binding an object (which lives on the heap) to the session with a reference.
The limits you will run into have more to do with the amount of RAM allocated to your appserver, the number of sessions running, and the size and number of the objects being kept in memory due to having an active reference around.
Session is implemented with a Java collection Map so it doesn't really store the objects - it stores a reference to an object. The only practical limit is the amount of memory you want to use. So if 100 sessions all have a reference to the same object, the only extra memory required is for the keys and references. Servlet containers are allowed to manage sessions by serializing them to disk - particularly when memory gets tight - in that case all of the attached objects must be Serializable or you lose them.
Also if you are planning to write any code which might put so much in session that you hit OutOfMemoryExceptions, I'd revist your design. Its better to keep sessions small; for example when you use things like clustering sessions need replicated between web container instances. Big sessions == a lot to replicate.