Thanks!
It is like the same as opening a session in Putty, where it sends the password automatically and don't ask for it.
Maybe if you add a command-line option to receive session password...
I've thought we talk about master password, not session password. Problem with passing password on command-line is that it is easy to retrieve the command-line used to execute any process. So it is not particularly safe. When passing session password to PuTTY, I guess it is obvious for security-concerned users that it is happening, so they can asses the risk. When opening WinSCP session in new window, I guess most people do not realize that new instance of WinSCP is started, so they may not be aware of the risk. Moreover, we should protect master password much more then session passwords.