I am not actually in the know about the level of sophistication of current spambot tools, but since open-source browsers exist, it doesn't seem out of the realm of possibility for someone to add their own robot routines to the source code of a browser and re-compile. Then they could interpret Javascript, store cookies, and send user-agent identifiers just like a browser. But they still won't be able to see PHP session variables (because they're on the server), so I'm banking on that.
If I'm missing something, and it's fairly certain that Javascript-smart robots are not on the horizon yet, let me know, because I won't need to be nervous about obfuscating email addresses merely by using Javascript to assemble pieces. As it stands, some of my web sites (I maintain five) still have "some assembly required" Javascript email links, but others have gone to having only a contact form. I don't know how paranoid to be, but as they say, "It's not paranoia if they really are out to get you!