It appears that, if this function returns false, it causes "session_start(): Failed to read session data: user" to be emitted in the error log. This also seems to have a cascading effect that causes the write() method not to be called.
So, returning false appears to only be for indicating an error state. To indicate that there is no existing session, but that it is okay to create one, it appears that returning an empty string is the way to go.