When Tomcat 8.5.12 process an incoming request that has a path that maps to a servlet with a wildcard-mapping. The following exception is thrown:

java.lang.NullPointerException
        at org.apache.catalina.core.ApplicationMapping.getServletMapping(ApplicationMapping.java:62)
        at org.apache.catalina.core.ApplicationContext.getRequestDispatcher(ApplicationContext.java:486)
        at org.apache.catalina.core.ApplicationContextFacade.getRequestDispatcher(ApplicationContextFacade.java:222)

I'm able to reproduce the behavior using the default ROOT web-app that is part of the tomcat distribution with two small changes:

Add a servlet-mapping in web.xml:

 <servlet-mapping>
        <servlet-name>default</servlet-name>
        <url-pattern>/static/*</url-pattern>
</servlet-mapping>

Replace the index.jsp page with the following lines:

<%@ page language="java"%>
<%
   javax.servlet.RequestDispatcher d = request.getServletContext().getRequestDispatcher("/static");
   out.println(d);
%>

Accessing http://localhost:8080/ with a browser presents an error page and the following log message in the localhost log:

org.apache.catalina.core.StandardWrapperValve.invoke Servlet.service() for servlet [jsp] in context with path [] threw exception [An exception occurred processing JSP page /index.jsp at line 3

1: <%@ page language="java"%>
2: <%
3:    javax.servlet.RequestDispatcher d = request.getServletContext().getRequestDispatcher("/static");
4:    out.println(d);
5: %>


Stacktrace:] with root cause
 java.lang.NullPointerException
        at org.apache.catalina.core.ApplicationMapping.getServletMapping(ApplicationMapping.java:62)
        at org.apache.catalina.core.ApplicationContext.getRequestDispatcher(ApplicationContext.java:486)
        at org.apache.catalina.core.ApplicationContextFacade.getRequestDispatcher(ApplicationContextFacade.java:222)
        at org.apache.jsp.index_jsp._jspService(index_jsp.java:112)
        at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
        at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:443)
        at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:385)
        at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:329)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:230)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)
        at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:80)
        at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:624)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:341)
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:783)
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:798)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1441)
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
        at java.lang.Thread.run(Thread.java:745)

If I substitute "/static" with "/other" or "/static/" everything works correctly.
When using Tomcat 8.5.11, the "/static" path works as expected so the behavior is introduced in Tomcat 8.5.12.

I tried to debug the request using a debugger and found that the code fails in the following snippet in ApplicationMapping:

                    case PATH:
                        mapping = new MappingImpl(mappingData.pathInfo.toString().substring(1),
                                mappingData.wrapperPath.toString() + "/*",
                                mappingData.matchType, servletName);
                        break;

and the reason for the NPE is that mappingData.pathInfo is null.

Since I'm not familiar with tomcat internals I don't know if the code should check for null or if the switch case is wrong. There is a another case (EXACT:) that maybe should have matched instead. 

I hope the description is enough to reproduce the NPE.