The difference is in the length of their existance.
An application variable exists from when the application is first 'run' (The first time a page in the app is used) and exists until the application is stopped on the server, either through IIS or the actual machine being turned off or rebooted.
A session variable is created for the instance of the browser accessing the site and will only be available until that browser is closed or the session times out.
They say, best men are moulded out of faults,
And, for the most, become much more the better
For being a little bad.