Storing objects of custom type in $_SESSION - legal way?
actually, I have found a workaround to do so without patching the core.

it is simple.

Drupal 7 core includes all module files which have hook_boot() registred, prior to open session, but hook_boot() is called only then session is started.

What you need to do - is to manually include class declaration outside of a hook_boot() (in a root context of a file containing hook_boot() of your module).

Such code is immediately executed as file being included by Drupal Core (prior to session_start() call), which gives us the desired behavior - we now can store objects of a CustomClass in $_SESSION variable and they wont become corrupted on next page load.

but be carefull if your CustomClass is extending from AnotherCustomClass located in different module and loaded by same mechanics (as described above) - you cannot be sure in order file loads.
This can lead to fatal runtime error: Undefined class