The default toolkit under macos is LWCToolkit. It JDK8 this overrides getImage:
    public Image getImage(URL url) {

        if (imageCached(url)) {
            return super.getImage(url);
        }

       URL url2x = getScaledImageURL(url);
        return (imageExists(url2x))
               ? getImageWithResolutionVariant(url, url2x) :super.getImage(url);
    }
getScaledImageURL may return null. While SunToolkit.imageExists does checkfor null, it does this after a call to checkPermissions:

    protected static boolean imageExists(URL url) {
        checkPermissions(url);
        if (url != null) {
            try (InputStream is = url.openStream()) {
                return true;
            }catch(IOException e){
                return false;
            }
        }
        return false;
    }
Unfortunately, if there's a SecurityManager that checkPermissions call eventually ends up in URLUtil:

    public static Permission getConnectPermission(URL url) throws IOException
{
        String urlStringLowerCase = url.toString().toLowerCase();

Where the null url gets dereferenced.