The session timeout specifies how long a visitor has between "clicks" before his session will timeout. If a session timeout is set to 5 minutes, the session will continue on indefinitely as long as the visitor clicks a CF page within 5 minutes and the page is part of the application that set the session. If a visitor were to click a page, wait 6 minutes, and then click again, they would receive new session variables and thus have a new session.
Hope this helps,
GJ