You can hijack it in unprotected WiFi easily (e.g. firesheep), but even if it's protected, an attacker can use ARP poisoning to route all traffic to the attacker, and thus steal the sessions (and firesheep should still work in this case).
Just keep it under your hat lest someone put it into a firefox extension.
So in the old days, that was networks using hubs (instead of switches), these days it's wireless networks.