NullReferenceException on LogOut, LogInAsAnotherUser

Question

After getting Kerberos working with Classic authentication, we're trying to switch to Kerberos & Claims-Based authentication.

This seems to work with respect to logging in, but we get NullReferenceExceptions (masked by "An unexpected error has occurred.") when trying to log out, including when clicking Sign In as Different User.

Using ILSpy I've found the sections of code where the exception is occurring, but I can't pinpoint the exact place and use that to find out what we can change to avoid the exceptions.

One example of where the exception is thrown is the following method in Microsoft.SharePoint.ApplicationPages.AccessDeniedPage:

private void LogInAsAnotherUser()
{
    SPIisSettings iisSettingsWithFallback = base.Site.WebApplication.GetIisSettingsWithFallback(base.Site.Zone);
    if (iisSettingsWithFallback.UseClaimsAuthentication)
    {
        FederatedAuthentication.SessionAuthenticationModule.SignOut();
        bool flag = iisSettingsWithFallback.UseWindowsClaimsAuthenticationProvider && iisSettingsWithFallback.ClaimsAuthenticationProviders.Count<SPAuthenticationProvider>() == 1;
        string text;
        if (flag)
        {
            text = ((iisSettingsWithFallback.GetClaimsAuthenticationLoginRedirectionUrl() == null) ? null : SPUtility.EnsureUrlSkipsFormsAuthModuleRedirection(iisSettingsWithFallback.GetClaimsAuthenticationLoginRedirectionUrl().ToString(), false));
        }
        else
        {
            text = "Authenticate.aspx";
        }
        if (!string.IsNullOrEmpty(text))
        {
            SPUtility.Redirect(this.BuildRedirectUrl(text), flag ? SPRedirectFlags.Trusted : SPRedirectFlags.RelativeToLayoutsPage, this.Context);
        }
    }
    SPUtility.HandleLoginAsAnotherUser(true);
}

Similar code appears in e.g. RemoveCookiesAndRedirect() in Microsoft.SharePoint.ApplicationPages.SignOutPage

I'd like to find out which object is unexpectedly null, and then what settings to change to stop it being null.