I managed to crash javac with the following stack trace:

An exception has occurred in the compiler (20-internal). Please file a bug against the Java compiler via the Java bug reporting page (https://bugreport.java.com) after checking the Bug Database (https://bugs.java.com) for duplicates. Include your program, the following diagnostic, and the parameters passed to the Java compiler in your report. Thank you.
com.sun.tools.javac.util.ClientCodeException: java.lang.NullPointerException: Cannot invoke "javax.lang.model.element.Element.getKind()" because "elem" is null
        at jdk.compiler.interim/com.sun.tools.javac.api.ClientCodeWrapper$WrappedTaskListener.started(ClientCodeWrapper.java:869)
        at jdk.compiler.interim/com.sun.tools.javac.api.MultiTaskListener.started(MultiTaskListener.java:119)
        at jdk.compiler.interim/com.sun.tools.javac.main.JavaCompiler.attribute(JavaCompiler.java:1310)
        at jdk.compiler.interim/com.sun.tools.javac.main.JavaCompiler.compile(JavaCompiler.java:947)
        at jdk.compiler.interim/com.sun.tools.javac.main.Main.compile(Main.java:317)
        at jdk.compiler.interim/com.sun.tools.javac.main.Main.compile(Main.java:176)
        at jdk.compiler.interim/com.sun.tools.javac.Main.compile(Main.java:64)
        at jdk.compiler.interim/com.sun.tools.javac.Main.main(Main.java:50)
Caused by: java.lang.NullPointerException: Cannot invoke "javax.lang.model.element.Element.getKind()" because "elem" is null
        at jdk.compiler.interim/com.sun.tools.javac.model.JavacTypes.getOverriddenMethods(JavacTypes.java:327)
        at jdk.javadoc.interim/jdk.javadoc.internal.doclint.Env.setCurrent(Env.java:220)
        at jdk.javadoc.interim/jdk.javadoc.internal.doclint.Checker.scan(Checker.java:161)
        at jdk.javadoc.interim/jdk.javadoc.internal.doclint.DocLint$2.visitDecl(DocLint.java:293)
        at jdk.javadoc.interim/jdk.javadoc.internal.doclint.DocLint$DeclScanner.visitPackage(DocLint.java:409)
        at jdk.javadoc.interim/jdk.javadoc.internal.doclint.DocLint$DeclScanner.visitPackage(DocLint.java:398)
        at jdk.compiler.interim/com.sun.tools.javac.tree.JCTree$JCPackageDecl.accept(JCTree.java:656)
        at jdk.compiler.interim/com.sun.source.util.TreePathScanner.scan(TreePathScanner.java:92)
        at jdk.compiler.interim/com.sun.source.util.TreeScanner.visitCompilationUnit(TreeScanner.java:150)
        at jdk.javadoc.interim/jdk.javadoc.internal.doclint.DocLint$DeclScanner.visitCompilationUnit(DocLint.java:442)
        at jdk.javadoc.interim/jdk.javadoc.internal.doclint.DocLint$DeclScanner.visitCompilationUnit(DocLint.java:398)
        at jdk.compiler.interim/com.sun.tools.javac.tree.JCTree$JCCompilationUnit.accept(JCTree.java:619)
        at jdk.compiler.interim/com.sun.source.util.TreePathScanner.scan(TreePathScanner.java:92)
        at jdk.javadoc.interim/jdk.javadoc.internal.doclint.DocLint$3.started(DocLint.java:304)
        at jdk.compiler.interim/com.sun.tools.javac.api.ClientCodeWrapper$WrappedTaskListener.started(ClientCodeWrapper.java:865)
        ... 7 more

The easiest way to reproduce the crash is to run:
make clean java.base-java JDK_FILTER=jdk/internal/event

That will generate a long command line. I have tried to shorten it down and remove irrelevant stuff while still provoking the crash. The important options (if I remove them I can't reproduce) seem to be:

-Xprefer:source -Xdoclint:all '-Xdoclint/package:java.*,nonexisting.*'

and it is crucial that we have compiled some java files to bytecode already. But once you have run the command above, the crash can be reproduced by this (more or less minimal) command line:

java -Xms64M -Xmx1600M -Duser.language=en -Duser.country=US -XX:+UnlockDiagnosticVMOptions -XX:-VerifySharedSpaces -XX:SharedArchiveFile=build/macosx-aarch64/configure-support/classes.jsa -Xshare:auto --limit-modules java.base,jdk.zipfs,java.compiler.interim,jdk.compiler.interim,jdk.javadoc.interim --add-modules java.compiler.interim,jdk.compiler.interim,jdk.javadoc.interim --module-path build/macosx-aarch64/buildtools/interim_langtools_modules --patch-module java.base=build/macosx-aarch64/buildtools/gensrc/java.base.interim --add-exports java.base/sun.reflect.annotation=jdk.compiler.interim --add-exports java.base/jdk.internal.jmod=jdk.compiler.interim --add-exports java.base/jdk.internal.misc=jdk.compiler.interim --add-exports java.base/sun.invoke.util=jdk.compiler.interim --add-exports java.base/jdk.internal.javac=java.compiler.interim --add-exports java.base/jdk.internal.javac=jdk.compiler.interim -m jdk.compiler.interim/com.sun.tools.javac.Main -Xprefer:source -Xdoclint:all '-Xdoclint/package:java.*,nonexisting.*' --module-source-path "src/*/share/classes" -d . src/java.base/share/classes/jdk/internal/event/DeserializationEvent.java