Are there any security concerns with getting the UID by simply querying the sessions table against the visitor's cookie?
The approach is vulnerable to a man-in-the-middle attack but just like any connection that isn't encrypted (HTTP). An attacker could use this to read the comments of nodes they otherwise don't have access to.

Otherwise, without knowing more context of how this used and displayed I can't say there are no other security concerns. I'll comment on a possible XSS issue with your comment display code at http://drupal.org/node/1922406.

I would recommend that you check for the session cookie though:

if (!empty($session_name) &amp;&amp; !empty($_COOKIE[$session_name])) {