As the spring reference manual states in Chapter 3, session scope:
Scopes a single bean definition to the lifecycle of a HTTP Session. Only valid in the context of a web-aware Spring ApplicationContext.
Your code, if invoked via a web-aware Spring ApplicationContext (most likely an XMLWebApplicationContext), will automatically be injected with different session scoped beans as they are invoked by different users as long as the proper spring configuration is set up to inject these session scoped beans. Then, your code can ignore where they came from and focus on using the user attributes, etc, found in the session scoped bean - without worrying what actually injected the property.
So, I guess the true answer is that you cannot test this - but nor do you need to - if someone is asking you to do this, then "they're doing it wrong".