Session.getPageMaps first gets all attributes names, then it add all pageMaps with a name of a pageMap.
But another thread with the same session might remove the attribute in the time between the get attribues names and the get of the attribute.
So the result will include a null object that will throw null pointer in the sort.
The senario is basicly related to previous bug where pageMap was created for link with popup (So pageMap would exceed max level and massive removal of pageMaps).
But this could still happen, and should be easy to fix (Just don't add a null pageMap to the list)...