I fixed this.
There were a couple of issues:
a) The ref was being added to the messagesToAck map *after* it had been delivered to the client. This means that if a client quickly acks the ack can arrive back on the session before it's been added to the map and NPE occurs.
b) The structures and non final members in StompSession were not concurrent structures, even though the class can be accessed by more than one thread. This could result in stale views.