That's a weird one. I use crystal as well, but I use the asp scripts to serve them up.
What do you have your session timeout set to? Check the administrator settings as well. Since you are linking to a .rpt file, you have left cold fusion so to speak, so if a person looks at the report for longer than the allotted session time, then the session would expire.
But that doesn't really sound like the case here. I have had a lot of memory problems with Crystal -- if the memory on the server gets bogged down, your session variables can get stomped on and look like they have expired. I had a rogue vb app that was doing it to mine.
One thing to try is to link to a frameset -- the first frame would take up 100% and you have another frame that is "hidden". Have the first frame automatically redirect to the .rpt file. The "hidden" frame would be a link to a .cfm file with really nothing in it that automatically refreshes. What this would do is keep your session alive. For debugging, make the hidden frame more visible and check to make sure session is still alive after the link.
Just a thought.
HTH,
Tim P.