I added some code to close the Statement and Connection objects, but during my test which produced the NPE, I was repeatedly clicking before the link had finished loading, so the call to close the connection object at the bottom of the page wasn't being reached before another request came through. This is most likely the problem.
I have found a way around it though that doesn't involve a complete redesign of my code. I don't get the errors when I just make a straight JDBC call to the database without using the JDBC Resource and Connection Pooling in Glassfish. If I go straight from the driver to the database, it works without any problem.
[Message sent by forum member 'malakh' (malakh)]
http://forums.java.net/jive/thread.jspa?messageID=261269