Why you want to set the actor id to null when user closes the browser or session timeout?
I don't think session timeout is same as cancelling a task. Just imagine a scenario where you are working on a task and you are out for say 5 minutes and when you come back, the task is not there in your list because session timeout nullifying the user.
Hope that helps.
You could rely instead of a jBPM timer in general for a cancellation/reassigning. You could give a user 1 day to do something, otherwise it's gone.
It's not particularly fair to kill something for a user if his browser closes. Maybe his computer crashed, his network dropped, accidentally clicked on an external link, or closed the window.