Since the implementation of JDK-6924099 in 7u25 (also backported to 6u51 and all later releases) a minimal jnlp file such as:
<jnlp>
   <resources>
      <jar href="http://oklahoma.us.oracle.com/www/tests/sandbox/hello.jar" />
   </resources>
 <application-desc main-class="hello"/>
</jnlp>
will throw an NPE.
This is because JNLPClassLoader.getPermissions() was modified to call LaunchDesc.getCodebase().getHost() to get the download host.
note jnlp specification does not require codebase if all resources are fully qualified.
also note - before jnlp spec version 8.20, information descriptor with title and vendor was required, since then it is optional.

The fix is quite simple, LaunchDownload uses mainJar.getLocation().getHost() as the download host.
other option is to not grant URLPermissions to codesource URL unless codebase is defined.

same problem does not apply to plugin since codebase is implicitly defined as docbase when codebase is not specified in jnlp file.