Hi Tim,
You are completely right, the garbage collector will skip these objects and the Client's memory may pile up with objects associated to the Session.
So rule of thumb: use as little as possible NPE associations to User or Session, preferably none.
If you do: try to minimize the objects, preferably use one object (retrieve list and get head), to minimize load.
I'm curious to the use-case where you would require to have a list of objects associated to user/session. Could you elaborate on that?
Maybe you could then consider a cleanup microflow, although it might be difficult to find the right triggers, as navigating to any other page might be one.
Good luck!