Rob, there is no such thing as `NullEventPublisher` in Spring Framework or Spring Security. There are no implementations of `ApplicationEventPublisher` that I can find in either framework that do what you're suggesting. Additionally, Spring Security classes `AbstractSecurityInterceptor`, `AbstractJaasAuthenticationProvider` and many others in Spring Security initialize their `ApplicationEventPublisher`s to null.

However, what they DO all do is check to make sure the event publisher isn't null before publishing an event. I can do that to ensure that a NPE is never thrown, and add an appropriate test as well.