ZK has a listener for changed of session attributes (see org.zkoss.zk.ui.http.HttpSessionListener23. When such a listener is called, ZK tries to get the default session. Since there is no default session (yet), a new session is created.

This causes stack overflows when some library installs a listener for sessionCreated() and inside of that, changes an attribute. The attribute change will trigger ZK's listener which will create a new session triggering the sessionCreated() listener ...