As you thought, there was the potential for the code to attempt to access a property on a null reference, and that's been taken care of. Of course, even if it had gotten past that point, you'd have been sent to a 404 page on account of the return URL being incorrect (it was missing an "s").
There was also an additional problem with an edge case related to user merges that I fixed while I was in there.
The changes have to be pulled into the main repository and then deployed before they'll go live, but hopefully you'll see this fixed on the site soon. Thanks for the report! Now I can start Sunday off feeling like I did something productive by fixing three issues at once, and before getting coffee at that.