JohnMu from Google warned one webmaster over the New Year Break in a Google Webmaster Help thread to never put session IDs in the Sitemap file.
John said:
If you are not submitting clean URLs in your Sitemap file, you’d be better off not using a Sitemap file. With session-IDs in there, it’ll cause more problems (with us crawling and indexing those URLs) than if you just let us crawl your website normally (especially if you really have a clean URL structure). So my advice would be to either delete the Sitemap file, or make sure that the submitted URLs are really exactly the same, clean ones that we find while crawling.
It is obvious for most of us, however, it is necessary to be clarified here.
Sending Google duplicated URLs for the same landing page is asking for trouble. If you do this, you are handing Google duplicate content on a silver plater. If you have duplicate content on your site, and you don’t block it from Google, then Google has a better shot of figuring it out based on crawling your site versus seeing it in a Sitemap file.
So no duplicated URLs or session ID based URLs should be listed in a Sitemap file.