In ZK 5.0.12 HttpSessionListener could be specified in web.xml (as in http://books.zkoss.org/wiki/ZK_Installation_Guide/ZK_Background/Sample_of_web.xml_for_Servlet_2.4).

    <listener>
        <description>ZK listener for session cleanup</description>
        <listener-class>org.zkoss.zk.ui.http.HttpSessionListener</listener-class>
    </listener>

This allowed to replace the default org.zkoss.zk.ui.http.HttpSessionListener with an extended version used to fix a particular issue (see http://forum.zkoss.org/question/73604/session-stack-overflow/?answer=85418#post-id-85418, last post), which simply adds a rule to ignore a specific attributeAdded event.

However it is no longer possible in ZK 6.5.0 or 6.5.2 as org.zkoss.zk.ui.http.HttpSessionListener is registered automatically. Because of that, while using the same configuration, both the extended version (package.HttpSessionListenerEx, specified in web.xml) and standard org.zkoss.zk.ui.http.HttpSessionListener are notified about the event, causing the StackOverflow issue mentioned in the forum post.

It should be possible to either:
a) specify which HttpSessionListener class to use, or
b) provide a mechanism to hook into HttpSessionListener23#shallIgnore(String name) method