What would be the expected behavior? Throwing an exception with message “Cannot retrieve User’s state because session is not yet started.”? I think it would be simply inconvenient for most use cases. For specific use cases where you don’t want the session to be initalized implicitly, you can extend CWebUser and override init().
For things like user->isGuest and user->id I expect to return true and null, respectively, without opening a session as a by product.
I’ll probably extend CWebUser and do as you suggested but that’s something to avoid, if better solutions or workaround exists. I’m afraid that if I’ll tinker with CWebUser.init() method that will introduce elusive bugs.