class com.atlassian.jira.web.bean.UserBrowserFilter throws a NullPointerException if any user has a null email. see around line 72 in that class.

I expect that under "normal" circumstances, a user's email can never be null. But there is nothing in the underlying OSUser contract that requires this, and its best to be cautious.