Is it safe to use $_SESSION to store temporarily a user provided value under multi-step form processing
Drupal has an Ajax framework for this use case. Use $form_state to store values. The API page about the Ajax framework contains a use of $form_state.