I do this:

InputStream st = ... // stream with the doc file
NPOIFSFileSystem fs = new NPOIFSFileSystem(st);
HWPFDocument doc = new HWPFDocument(fs.getRoot());
ByteArrayOutputStream baos = new ByteArrayOutputStream();
doc.write(baos);

I get this:

java.lang.NullPointerException
	at org.apache.poi.hwpf.HWPFDocument.deleteEntrySafe(HWPFDocument.java:980)
	at org.apache.poi.hwpf.HWPFDocument.write(HWPFDocument.java:951)
...

It seems that the HWPFDocument.write relies on the fact that directory.getFileSystem() will return a non-null object. Unfortunately, when using the NPOIFSFileSystem, this is not the case. A workaround would be to add a 
	
if (pfs == null) {
    pfs = new POIFSFileSystem();
}

This seems to work for me.