NumberUtils#createNumber checks for a leading "--" in the string, and returns null if found. This is documented as a work round for a bug in BigDecimal.
Returning nulll is contrary to the Javadoc and the behaviour for other methods which would throw NumberFormatException.
It's not clear whether the BigDecimal problem still exists with recent versions of Java. However, if it does exist, then the check needs to be done for all invocations of BigDecimal, i.e. needs to be moved to createBigDecimal.