Turns out that my assumption was right: The presence of a null
returning FactoryBean whose getObjectType() result matches a given injection point, with more than one matching bean present, can lead to a NullPointerException if there is no primary match otherwise... e.g. if the FactoryBean result would be chosen based on a bean name match. I've added a unit test for this and made the determineAutowireCandidate more defensive now, simply through only calling ConcurrentHashMap.contains in case of a nonnull bean instance.
A general lesson here: It's not sufficient to check whether a given Map may actually contain null values before turning it into a ConcurrentHashMap (or other impl which doesn't allow null values). We also need to make sure that nobody calls containsValue / values().contains with a null argument since such impls will throw a hard NPE there.