Do Session Attributes get GC'ed After Session Times Out?

[Mississippi John Hurt]

Hi,
Say I set some HttpSession attributes. If I set the timeout to 30 minutes,
and the user leaves for lunch and never comes back for 3 days, does the
session attributes get garbage collected?  Or do I have to explicitly
invalidate the session (ie when the user comes back say 3 days later and
hits the web page again), in order for his session attributes to get
"cleaned up"?  Thanks.