Spec says about CookiePolicy.shouldAccept():

---------------------------8<--------------------------------
boolean shouldAccept(URI uri,
                     HttpCookie cookie)

    Will be called to see whether or not this cookie should be accepted.

    Parameters:
        uri - the URI to consult accept policy with
        cookie - the HttpCookie object in question
    Returns:
        true if this cookie should be accepted; otherwise, false

---------------------------8<--------------------------------

No NPE is documented.
However it is thrown when CookiePolicy.ACCEPT_ORIGINAL_SERVER.shouldAccept() is called and either or both of parameters is null.