ref:
http://ez.no/developer/forum/setup_design/automatically_logout_user_after_some_period_of_inactivity

The user wants to be able to logout users that have been inactive for a certain while. At first look, one would think that this is what ActivityTimeout setting is for. But the setting is documented as "considered inactive/logged out", stating nothing about the user actually being logged out.
So this is for logged in lists on community sites and stuff like that.

Next would be to try to use SessionTimeout for this, but both in stable/4.0 and trunk, this setting does not seem to have any effect (cleared cookies to get new session and all).

This makes me conclude that SessionTimeout is broken, but I'm not sure though.