I first saw this problem in 1.322, then I upgraded to 1.324 and the problem is
there as well. Interestingly, I see this error behavior only on my Tomcat
deployment, not in my winstone one, which is running 1.323.

The repro path is to a specific user config page and try to change the password
or even just hit Save. I get an Error 500 caused by a NPE as follows:

javax.servlet.ServletException: java.lang.NullPointerException
org.kohsuke.stapler.Stapler.invoke(Stapler.java:499)
org.kohsuke.stapler.MetaClass$6.doDispatch(MetaClass.java:179)
org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:30)
org.kohsuke.stapler.Stapler.invoke(Stapler.java:487)
org.kohsuke.stapler.Stapler.invoke(Stapler.java:403)
org.kohsuke.stapler.Stapler.service(Stapler.java:116)
javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:94)
hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:86)
hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:78)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:84)
hudson.plugins.audit_trail.AuditTrailFilter.doFilter(AuditTrailFilter.java:35)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:84)
hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:51)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
org.acegisecurity.ui.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:166)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(AnonymousProcessingFilter.java:125)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
org.acegisecurity.ui.rememberme.RememberMeProcessingFilter.doFilter(RememberMeProcessingFilter.java:142)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:271)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter(BasicProcessingFilter.java:173)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249)
hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:66)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76)
hudson.security.HudsonFilter.doFilter(HudsonFilter.java:155)

root cause

java.lang.NullPointerException
hudson.model.UserProperty.reconfigure(UserProperty.java:78)
hudson.model.User.doConfigSubmit(User.java:426)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
java.lang.reflect.Method.invoke(Method.java:597)
org.kohsuke.stapler.Function$InstanceFunction.invoke(Function.java:185)
org.kohsuke.stapler.Function.bindAndInvoke(Function.java:101)
org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:54)
org.kohsuke.stapler.MetaClass$1.doDispatch(MetaClass.java:73)
org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:30)
org.kohsuke.stapler.Stapler.invoke(Stapler.java:487)
org.kohsuke.stapler.MetaClass$6.doDispatch(MetaClass.java:179)
org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:30)
org.kohsuke.stapler.Stapler.invoke(Stapler.java:487)
org.kohsuke.stapler.Stapler.invoke(Stapler.java:403)
org.kohsuke.stapler.Stapler.service(Stapler.java:116)
javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:94)
hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:86)
hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:78)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:84)
hudson.plugins.audit_trail.AuditTrailFilter.doFilter(AuditTrailFilter.java:35)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:84)
hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:51)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
org.acegisecurity.ui.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:166)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(AnonymousProcessingFilter.java:125)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
org.acegisecurity.ui.rememberme.RememberMeProcessingFilter.doFilter(RememberMeProcessingFilter.java:142)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:271)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter(BasicProcessingFilter.java:173)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249)
hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:66)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76)
hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76)
hudson.security.HudsonFilter.doFilter(HudsonFilter.java:155)