I've been trying to understand the autostart mechanism in Gnome 2 for a small program I'm working on. This may continue to be a supported system in gnome-3, since it seems to be standardized by freedesktop.org and not the Gnome "Let's just rewrite around our bugs and drop features" team.
Without further ado or bitterness, here's a brief but technical dive into the modern autostart system on Gnome 2, as observed on a Lucid Lynx system (originally installed as Intrepid Ibex, I believe.) [Updated: autostart itself is also a freedesktop standard.]
The autostart system is built on the aforementioned XDG Base Directory specification. Inside the config dirs are directories named "autostart", and these directories are filled with .desktop files. By default, a desktop file in one of these directories represents an application to be auto-started. The file may override this by including the line, "X-GNOME-Autostart-enabled=false". [10/10: Actually, according to the autostart spec, it should use a line "Hidden=false" to accomplish this. Furthermore, an application will not be autostarted by Gnome if the desktop entry contains an OnlyShowIn key without GNOME in the value, or a NotShowIn key which includes GNOME. This lets KDE add autostarts for its services without disturbing Gnome, because OnlyShowIn=KDE is set.]
So, there are places like /usr/share/gnome/autostart, /usr/share/autostart, and /etc/xdg/autostart that contain these apps for the system. Then, ~/.config/autostart directory (where ~/.config is the default value for $XDG_CONFIG_HOME) contains any modifications to the system files made in the Startup Applications preferences window (on the System > Preferences menu).
I suspect that if your only modification in the preference pane is to turn off autostart for a command, then the system adds a .desktop file for the command to your home dir that disables the autostart. If you then turn the command back on, the system must be deleting your personal .desktop file to revert to the system-wide one. This accounts for reports of "~/.config/autostart isn't right, it only contains things that don't autostart." I'm pretty sure I looked into this system in the past, briefly, and thought the same thing.
If you add a custom item like freshwall to the Startup Applications preferences, then it creates a .desktop file in ~/.config/autostart with the configured command, but no disable-autostart line. So this autostart directory must be the correct one. I see that Dropbox also leaves a .desktop file in there. (And if you sign up through that link, you get an extra quarter gig of space.)
Obviously, the autostart directories are searched in a specific order, and the first matching filename wins, with the user-specific directories scanned before the system-wide ones. I don't know if all the autostart services run in any defined order, or in parallel.
Lastly, these autostart entries are hooked into the Gnome session manager. The session manager sets the DESKTOP_AUTOSTART_ID environment variable when launching the desktop, and a session-aware program should use this ID as the client ID when connecting to the session manager. Note that this is not XSMP, but a Gnome-specific service exported via D-Bus on the session bus under the name org.gnome.SessionManager. (There is another post planned on this session manager interface; but if you want to dig into it yourself, I recommend D-Feet, which is packaged for ubuntu. [10/10: Ubuntu also documents this interface at /usr/share/doc/gnome-session/dbus/gnome-session.html, but I can't find it anywhere on the Web to provide a link.])
To summarize: autostart relies on the XDG Base Directory specification; items in ~/.config/autostart override items in the system directories, in accordance with the spec; and a .desktop file containing the X-GNOME-Autostart-enabled=false line represents a command that will not be autostarted by Gnome. An app that's being autostarted by the Gnome session manager, which wants to connect to it, should use the client ID stored in $DESKTOP_AUTOSTART_ID.
References for this post: