I would say that your chances of collision is very, very, very small, even on Windows.
I wrote a benchmark once (using Benchmark) that used GUID and UUID (from UUID, not Data::UUID) to generate session keys for me. I ran it through 100k iterations on my windows box and it generated fast (1.1 seconds) and produced 0 collisions. I even had a variant that would cut the result to make the string 16 characters (substr(0, 16)) to save storage space. 0 Collisions in 1.1 seconds.
I just cut it further to 8 characters and it still produced no collisions.
Sure installing UUID is a pain on windows, and the code for using it is ugly, but I don't see a reason not to use it.