The issue is probably related to the change from Winstone to Jetty8, in Jenkins v1.535:
http://jenkins-ci.org/changelog#v1.535
I have reproduced the issue locally after a load test (the sessions chart shows a high number of sessions, but there are only one session in the list of sessions).
In the report http://localhost/monitoring?part=heaphisto or in a heap dump, I can also see that there is exactly the same high number of instances of org.eclipse.jetty.server.session.HashedSession existing in memory, as in the chart.
The cause can be related to the following jetty bug (fixed in Jetty 9.1, which is later than Jetty 8 used by Jenkins):
https://bugs.eclipse.org/bugs/show_bug.cgi?id=413019
So the invalidated http sessions are not garbage collected, there is a small memory leak in the monitoring plugin, and the sessions chart is "not right".
I will fix that, with a workaround for the jetty bug.
I see the same issue in our 1.539 instance.
What's worse is that I see a significant increase in sessions before the service becomes unresponsive and has to be restarted.
Currently we have ~200 sessions in the counter, but only ~12 sessions listed.