Here it is:
private void Invoke_SetSession(InvocationDetails details)
{
// validate session
var sessionID = ...
if (!_host.SessionManager.ExistSession(sessionID))
{
throw new InvalidSessionException(...);
}
// now someone calls TerminateSession(sessionID), and session
// doesn't exist anymore, so GetSessionBySessionID returns null
// set current session
details.Session = _host.SessionManager.GetSessionBySessionID(sessionID); // returns null
details.Session.Timestamp = DateTime.Now; // NRE is thrown
...
}