This problem happens if parent component has been hidden by authorization strategy during the previous page render, but on the next render parent component becomes visible. This problem is common for all repeaters. The problem here is in internalOnAttach() method of repeaters. This method will not populate items if it not visible in hierarchy, but when it checks this it use old visible state (Component.FLAG_IS_RENDER_ALLOWED) of component (itself and parent components), this state is changed after setRenderAllowed() method in Component.java on 1630 line returns, but internalAttach() method is called earlier in Component.java on 1624 line. After that component become visible and will be rendered. But it can't be rendered because items were not populated, so null pointer exception occurs.
This problem can be fixed if method calls of internalAttach() and setRenderAllowed(isActionAuthorized(RENDER)) will be swapped or logic of repeaters (ListView, DataView, etc) components will be changed.