Recently I started tested Neovim with NULL values (lists, dictionaries and strings) and found the following invalid behaviours. “(confirmed)” marks behaviours confirmed in Vim-7.4.1749 with my patches (I mean, guicolors patch: this is the Vim I use; patch does not alter behaviour of functions in question).

• map(v:_null_list, 'v:val') returns 0. It should return v:_null_list. (confirmed)
• filter(v:_null_list, 'v:val') returns 0. It should return v:_null_list. (confirmed)
• add(v:_null_list, 1) returns 1, it should fail. Though with locked list it returns 1 as well, so probably it should fail and return 1. (confirmed)
• extend(v:_null_list, []) returns 0, it should fail. Again locked list returns 0 and fails. (confirmed)
• setreg('x', v:_null_list) crashes. Already reported. (confirmed)
• setline(1, v:_null_list) crashes. append() is fine. (confirmed)
• v:_null_list == v:_null_list returns 0. NULL list is not equal to itself! (confirmed) is operator works as expected.
• Same for v:_null_list == []: returns 0, should return 1. (confirmed)
• islocked('v:_null_list') does not crash. Though it does not return 1. I am not sure whether this needs to be fixed because e.g. islocked('v:throwpoint') is also zero (as it is VAR_FIXED and not VAR_LOCKED). (confirmed)
• v:_null_list + any_other_list is E15: Invalid expression, as well as any_other_list + v:_null_list. Since list + list produces a new list it should work like [] + any_other_list. (confirmed)
• count([v:_null_list], v:_null_list) returns 0 in place of 1. Guess same problem as with ==. (confirmed)
• extend([1], v:_null_list) returns 0 in place of returning [1]. (confirmed)
• inputlist(v:_null_list) treats this as non-list. (confirmed)
• writefile(v:_null_list, "/tmp/test.fname") returns 0, but does not actually do anything, with empty list it creates empty file (and returns 0). (confirmed)
• remove(v:_null_list, 0) returns 0 in place of E684. (confirmed)
• setqflist(v:_null_list) returns -1 (and I guess, does nothing with quickfix list), same for setloclist(1, v:_null_list). For empty list it returns 0. (confirmed)
• setmatches(v:_null_list) also returns -1 in place of 0 like with empty list. (confirmed)
• sort(v:_null_list) returns 0 in place of v:_null_list, yet does not error out. (confirmed)
• string(v:_null_list) returns empty string in place of []. Neovim behaves correctly here.
• json_encode(v:_null_list) encodes empty list as null, same for js_encode(). Neovim uses [] in first case and does not have js_encode().
• system("cat", v:_null_list) crashes, as well as systemlist(). (confirmed)
• for x in v:_null_list does not work as well, it thinks :for is given a non-list. (confirmed)
• cexpr v:_null_list thinks it was given a non-list in place of empty list. (confirmed)
• deepcopy(v:_null_list) returns an empty string without any errors. (confirmed)

Not tested: complete(), job/channel functions, most likely some Ex commands.
Works: count() (first position), (virt)?col(), line(), empty(), copy(), deepcopy(), indexing/slicing, function(), get(), len(), max()/min(), e =v:_null_list (works like e =[] and I am not sure whether that is correct, but this is a separate issue).

Not yet tested: many functions with v:_null_dict (note: I am not going to confirm this does (not) work in Vim because there is no v:_null_dict here). Lots and lots of functions with v:_null_string. Will raise a separate issue later.