If you use Subject.doAs(null, action), and the action causes a permission to be checked, SubjectDomainCombiner.combine throws a NullPointerException. Here's a simple test program:

import javax.security.auth.Subject;
import java.security.*;

public class Test {
    public static void main(String[] args) {
Subject.doAs(null, new PrivilegedAction() {
public Object run() {
AccessController.getContext().checkPermission(new AllPermission());
return null;
}
});
    }
}