well so far i couldn't see any pattern. i use forms authentification, below
is the web.config snippet. i receive notification when obj ref exception
occurs, but it doesnt help much. the only place where session data is being
written is after the login, when i put all the data regarding the logged on
user in a session object. after that i retrieve that data with
object UserData = System.Web.HttpContext.Current.Session["UserData"];

web.config:
<authentication mode="Forms">
            <forms name=".ASPXAUTH" loginUrl="Login.aspx"
defaultUrl="forme/home/Default.aspx" protection="All" timeout="60"
path="/"></forms>
        </authentication>

and this it the code that creates the object in session (which we use later
on as static property, Korisnik is the name of the class in app_code)

public static Korisnik Trenutni
   {
       get
       {
           object oKorisnik =
System.Web.HttpContext.Current.Session["korisnik"];
           if (oKorisnik != null)
               return ((Korisnik)oKorisnik);
           else
               return null;
       }
   }