This is hard to reproduce and I am putting it in as a bug in part for us to keep track of whether anyone else can trigger it. My user triggered it once and now can't- which I don't find surprising.

They were deleting a member in the cp and got this error. Which I see now way it should trigger the error. I don't think it's resetting the authtimeout on the user getting deleting- I think it's only the person getting deleted. So session should... be there.

I can't logic it out and I can't reproduce. But I suspect in certain limited circumstances this may be an actual bug. So either someone else will logic it out or we'll get some more reports and need to dig deeper or just put a check on the function to make sure it's not dealing with null.