I think you might have a point about the hidden variables encouraging hackers. I suspect the word "hidden" triggers the curious.
Of course you can always check the referrer, but I accept that is not foolproof.
The hidden session id is a neat idea. Sure, it does'nt stop the occasional attempt to snarf someone else's id, but the amount of effort required outweights the simple pleasure of a vicarious hacking attempt, unlike just editing a url query-string, which can be done on the spur of the moment.