This one is hard to test, but has been seen a lot during Slaughter House development:
Storing a player's VRCPlayerApi object within a UdonBehaviour, then calling GetPosition or GetRotation shortly after the player has left the world, will throw due to a null pointer.
What's odd is that the VRCPlayerApi object is not null, and properties on the object are not set to null (such as display name). It looks like GetPosition and GetRotation are just unsafe calls during cleanup of a disconnected player.
The correct behaviour here should be to return the default values for Vector3/Quaternion if the player is in the process of being removed, rather than throwing due to a null pointer.