AFAIK this preference is about cookies, not tabs.

Not according to this:

http://kb.mozillazine.org/Browser.sessionstore.privacy_level

"Firefox 2.0 introduces a built-in Session Restore feature, allowing the user to continue browsing from where they left off if browser restarts. This preference controls when to store extra information about a session: contents of forms, scrollbar positions, cookies, and POST data.

Possible values and their effects: 0 - Store extra session data for any site. (Default starting with Firefox 4.) 1 -Store extra session data for unencrypted (non-HTTPS) sites only. (Default before Firefox 4.) 2 - Never store extra session data."

Thanks!

In the source code, there are these comments:

// on which sites to save text data, POSTDATA and cookies
// 0 = everywhere, 1 = unencrypted sites, 2 = nowhere 
pref("browser.sessionstore.privacy_level", 0);

It sounds like scroll positions stored in session history data are not intended to be affected by this preference, as you discovered already.

Heh, well that's a comment, not the actual code where it's being used. BUT that said, yes the experimental evidence suggests the comment is right, and the documentation referenced above incorrect.

Thanks!

I started to trace where it's used in the code and as a person who is more of a scripter, it was a little hard to follow. Here's my rough understanding:

The question of whether to filter out certain data is addressed in TabState.jsm:

     // Filter sensitive data according to the current privacy level.
     if (!includePrivateData) {
       if (key === "storage") {
         value = PrivacyFilter.filterSessionStorageData(value);
       } else if (key === "formdata") {
         value = PrivacyFilter.filterFormData(value);
       }
     }

Those PrivacyFilter functions are in PrivacyFilter.jsm and call PrivacyLevel.check() in PrivacyLevel.jsm which is where Firefox reads the preference value, checks the URL, and returns true (save the data) or false (don't save the data).

Scroll position is handled separately.