Image picker crashes in newly created html field, but only first time after login

After logging into the CMS, the first usage of the image picker in a html field does not make the dialog show up. Instead, a stacktrace is produced on the console.

To reproduce it:

• login to the cms
• make a new document which has a list of html fields
• edit the document, add a new section which contains an html field
  (cms produces xinha stacktrace, nullpointer) see beneath
• the image picker shows empty
• close the image picker
• again, select image button in html field
• image picker shows correctly

Stacktrace cms:

ERROR - AbstractXinhaPlugin - Exception caught during editor creation while cleaning value: null
java.lang.NullPointerException
at nl.hippo.htmlcleaner.GeckoCorruptTagCleaner.clean(GeckoCorruptTagCleaner.java:29)
at nl.hippo.htmlcleaner.HtmlCleaner.clean(HtmlCleaner.java:45)
at nl.hippo.htmlcleaner.HtmlCleaner.cleanToString(HtmlCleaner.java:62)
at org.hippoecm.frontend.plugins.xinha.htmlcleaner.HtmlCleanerPlugin.clean(HtmlCleanerPlugin.java:60)
at org.hippoecm.frontend.plugins.xinha.AbstractXinhaPlugin.clean(AbstractXinhaPlugin.java:299)
at org.hippoecm.frontend.plugins.xinha.AbstractXinhaPlugin$5.setObject(AbstractXinhaPlugin.java:316)
at org.apache.wicket.Component.setModelObject(Component.java:2889)
at org.apache.wicket.markup.html.form.FormComponent.updateModel(FormComponent.java:1069)
at org.apache.wicket.markup.html.form.FormComponent.processInput(FormComponent.java:951)
at org.hippoecm.frontend.plugins.xinha.AbstractXinhaPlugin$7.handleRequest(AbstractXinhaPlugin.java:380)
at org.hippoecm.frontend.plugins.xinha.AbstractXinhaPlugin$7$1.respond(AbstractXinhaPlugin.java:367)
at org.apache.wicket.request.AbstractRequestCycleProcessor.respond(AbstractRequestCycleProcessor.java:104)
at org.apache.wicket.RequestCycle.processEventsAndRespond(RequestCycle.java:1181)
at org.apache.wicket.RequestCycle.step(RequestCycle.java:1252)
at org.apache.wicket.RequestCycle.steps(RequestCycle.java:1353)
at org.apache.wicket.RequestCycle.request(RequestCycle.java:493)
at org.apache.wicket.protocol.http.WicketFilter.doGet(WicketFilter.java:355)
at org.apache.wicket.protocol.http.WicketServlet.doPost(WicketServlet.java:145)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
at org.mortbay.jetty.servlet.ServletHolder.handle(ServletHolder.java:487)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1093)
at org.hippoecm.frontend.plugins.login.ConcurrentLoginFilter.doFilter(ConcurrentLoginFilter.java:54)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1084)
at org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:360)
at org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:216)
at org.mortbay.jetty.servlet.SessionHandler.handle(SessionHandler.java:181)
at org.mortbay.jetty.handler.ContextHandler.handle(ContextHandler.java:726)
at org.mortbay.jetty.webapp.WebAppContext.handle(WebAppContext.java:405)
at org.mortbay.jetty.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:206)
at org.mortbay.jetty.handler.HandlerCollection.handle(HandlerCollection.java:114)
at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152)
at org.mortbay.jetty.Server.handle(Server.java:324)
at org.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:505)
at org.mortbay.jetty.HttpConnection$RequestHandler.content(HttpConnection.java:843)
at org.mortbay.jetty.HttpParser.parseNext(HttpParser.java:648)
at org.mortbay.jetty.HttpParser.parseAvailable(HttpParser.java:211)
at org.mortbay.jetty.HttpConnection.handle(HttpConnection.java:380)
at org.mortbay.io.nio.SelectChannelEndPoint.run(SelectChannelEndPoint.java:395)
at org.mortbay.thread.QueuedThreadPool$PoolThread.run(QueuedThreadPool.java:488)