Probably not a perceptible one - table scans will walk the length of a varchar, so you'll be walking some 256-length entries when there are Facebook sessions active... not really a big deal imo.

 

That might be the sticking point. I can see some problems arising quickly from letting modules alter core tables:

-FB Connect sets sid to varchar(256)

-Foo.module, installed later, sets sid to varchar(128)

Now FB Connect doesn't work.

Quick alternate ideas that come to mind:

-Setting a PHP session instead

-Making a mapping table of FB sid -> drupal sid

-Doing what you're considering, but instead storing the FB sids as md5 hashes in the sessions table to keep the varchar(64) constraint

-Some combination of these

-D