On 9 dev tip, the following program triggers an NPE in the compiler:

// ---- 8< -----
import java.util.List;
import java.util.ArrayList;

class MethodRefToInnerBase {
  class TestString {
    String str;
    TestString(String strin) {
      str = strin;
    }
  }
}
public class X extends MethodRefToInnerBase {
  public static void main(String[] args) {
    List<String> list = new ArrayList<>();
    list.stream().forEach(TestString::new);
  }
}

// ----- 8< ---------

With this stack trace:

An exception has occurred in the compiler (1.9.0-internal). Please file a bug at the Java Bug Database (http://bugreport.java.com/bugreport/) after checking the database for duplicates. Include your program and the following diagnostic in your report. Thank you.
java.lang.NullPointerException
at com.sun.tools.javac.comp.Flow$FlowAnalyzer.visitApply(Flow.java:1237)
at com.sun.tools.javac.tree.JCTree$JCMethodInvocation.accept(JCTree.java:1598)
at com.sun.tools.javac.tree.TreeScanner.scan(TreeScanner.java:49)
at com.sun.tools.javac.comp.Flow$BaseAnalyzer.scan(Flow.java:404)
at com.sun.tools.javac.tree.TreeScanner.visitExec(TreeScanner.java:178)
at com.sun.tools.javac.tree.JCTree$JCExpressionStatement.accept(JCTree.java:1416)
at com.sun.tools.javac.tree.TreeScanner.scan(TreeScanner.java:49)
at com.sun.tools.javac.comp.Flow$BaseAnalyzer.scan(Flow.java:404)
at com.sun.tools.javac.tree.TreeScanner.scan(TreeScanner.java:57)
at com.sun.tools.javac.comp.Flow$FlowAnalyzer.visitBlock(Flow.java:999)
at com.sun.tools.javac.tree.JCTree$JCBlock.accept(JCTree.java:984)
at com.sun.tools.javac.tree.TreeScanner.scan(TreeScanner.java:49)
at com.sun.tools.javac.comp.Flow$BaseAnalyzer.scan(Flow.java:404)
at com.sun.tools.javac.comp.Flow$FlowAnalyzer.visitMethodDef(Flow.java:966)
at com.sun.tools.javac.tree.JCTree$JCMethodDecl.accept(JCTree.java:836)
at com.sun.tools.javac.tree.TreeScanner.scan(TreeScanner.java:49)
at com.sun.tools.javac.comp.Flow$BaseAnalyzer.scan(Flow.java:404)
at com.sun.tools.javac.comp.Flow$FlowAnalyzer.visitClassDef(Flow.java:929)
at com.sun.tools.javac.tree.JCTree$JCClassDecl.accept(JCTree.java:744)
at com.sun.tools.javac.tree.TreeScanner.scan(TreeScanner.java:49)
at com.sun.tools.javac.comp.Flow$BaseAnalyzer.scan(Flow.java:404)
at com.sun.tools.javac.comp.Flow$FlowAnalyzer.analyzeTree(Flow.java:1325)
at com.sun.tools.javac.comp.Flow$FlowAnalyzer.analyzeTree(Flow.java:1315)
at com.sun.tools.javac.comp.Flow.analyzeTree(Flow.java:212)
at com.sun.tools.javac.main.JavaCompiler.flow(JavaCompiler.java:1288)
at com.sun.tools.javac.main.JavaCompiler.flow(JavaCompiler.java:1257)
at com.sun.tools.javac.main.JavaCompiler.compile(JavaCompiler.java:865)
at com.sun.tools.javac.main.Main.compile(Main.java:253)
at com.sun.tools.javac.main.Main.compile(Main.java:141)
at com.sun.tools.javac.Main.compile(Main.java:56)
at com.sun.tools.javac.Main.main(Main.java:42)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:497)
at com.intellij.rt.execution.application.AppMain.main(AppMain.java:134)