Index: /trunk/src/VBox/Main/include/GuestImpl.h
===================================================================
--- /trunk/src/VBox/Main/include/GuestImpl.h	(revision 71633)
+++ /trunk/src/VBox/Main/include/GuestImpl.h	(revision 71634)
@@ -105,5 +105,5 @@
 #ifdef VBOX_WITH_GUEST_CONTROL
     int         i_dispatchToSession(PVBOXGUESTCTRLHOSTCBCTX pCtxCb, PVBOXGUESTCTRLHOSTCALLBACK pSvcCb);
-    int         i_sessionRemove(GuestSession *pSession);
+    int         i_sessionRemove(uint32_t uSessionID);
     int         i_sessionCreate(const GuestSessionStartupInfo &ssInfo, const GuestCredentials &guestCreds,
                                 ComObjPtr<GuestSession> &pGuestSession);
Index: /trunk/src/VBox/Main/src-client/GuestCtrlImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/src-client/GuestCtrlImpl.cpp	(revision 71633)
+++ /trunk/src/VBox/Main/src-client/GuestCtrlImpl.cpp	(revision 71634)
@@ -224,8 +224,6 @@
 }
 
-int Guest::i_sessionRemove(GuestSession *pSession)
-{
-    AssertPtrReturn(pSession, VERR_INVALID_POINTER);
-
+int Guest::i_sessionRemove(uint32_t uSessionID)
+{
     LogFlowThisFuncEnter();
 
@@ -234,37 +232,24 @@
     int rc = VERR_NOT_FOUND;
 
-    LogFlowThisFunc(("Removing session (ID=%RU32) ...\n", pSession->i_getId()));
-
-    GuestSessions::iterator itSessions = mData.mGuestSessions.begin();
-    while (itSessions != mData.mGuestSessions.end())
-    {
-        if (pSession == itSessions->second)
-        {
-#ifdef DEBUG_andy
-            ULONG cRefs = pSession->AddRef();
-            Assert(cRefs >= 2);
-            LogFlowThisFunc(("pCurSession=%p, cRefs=%RU32\n", pSession, cRefs - 2));
-            pSession->Release();
-#endif
-            /* Make sure to consume the pointer before the one of the
-             * iterator gets released. */
-            ComObjPtr<GuestSession> pCurSession = pSession;
-
-            LogFlowThisFunc(("Removing session (pSession=%p, ID=%RU32) (now total %ld sessions)\n",
-                             pSession, pSession->i_getId(), mData.mGuestSessions.size() - 1));
-
-            rc = pSession->i_onRemove();
-            mData.mGuestSessions.erase(itSessions);
-
-            alock.release(); /* Release lock before firing off event. */
-
-            fireGuestSessionRegisteredEvent(mEventSource, pCurSession,
-                                            false /* Unregistered */);
-            pCurSession.setNull();
-            break;
-        }
-
-        ++itSessions;
-    }
+    LogFlowThisFunc(("Removing session (ID=%RU32) ...\n", uSessionID));
+
+    GuestSessions::const_iterator itSessions = mData.mGuestSessions.find(uSessionID);
+    if (itSessions == mData.mGuestSessions.end())
+        return VERR_NOT_FOUND;
+
+    /* Make sure to consume the pointer before the one of the
+     * iterator gets released. */
+    ComObjPtr<GuestSession> pSession = itSessions->second;
+
+    LogFlowThisFunc(("Removing session %RU32 (now total %ld sessions)\n",
+                     pSession, uSessionID, mData.mGuestSessions.size() ? mData.mGuestSessions.size() - 1 : 0));
+
+    rc = pSession->i_onRemove();
+    mData.mGuestSessions.erase(itSessions);
+
+    alock.release(); /* Release lock before firing off event. */
+
+    fireGuestSessionRegisteredEvent(mEventSource, pSession, false /* Unregistered */);
+    pSession.setNull();
 
     LogFlowFuncLeaveRC(rc);
Index: /trunk/src/VBox/Main/src-client/GuestSessionImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/src-client/GuestSessionImpl.cpp	(revision 71633)
+++ /trunk/src/VBox/Main/src-client/GuestSessionImpl.cpp	(revision 71634)
@@ -2534,5 +2534,6 @@
 
     /* Remove ourselves from the session list. */
-    int rc2 = mParent->i_sessionRemove(this);
+    AssertPtr(mParent);
+    int rc2 = mParent->i_sessionRemove(mData.mSession.mID);
     if (rc2 == VERR_NOT_FOUND) /* Not finding the session anymore isn't critical. */
         rc2 = VINF_SUCCESS;