So I was wrong. Do NOT autorelease the string -- it gets explicitly released later on. Instead, just use some preprocessor directives to suppress the static analyzer.
Do not consider an empty string to be NSNull; consider it an empty string. And if somehow we do get a nil string, do consider that an NSNull.

See: http://yaml.org/type/null.html

"A null value is used to indicate the lack of a value. This is typically converted into any native null-like value (e.g., undef in Perl, None in Python). Note that a null is different from an empty string and that a mapping entry with some key and a null value is valid and different from not having that key in the mapping."

I'd have to look into my case further (it was a mapping entry with some key and "" for the value, so truly an empty string, not a NULL). For now, this is easiest for me to handle. But it should be revisited for a cleaner solution.