This is reproducable only with specific ACL settings. A NPE is thrown, and the code checking for null is checking the wrong variable.