Hi,
Am finally moving our project from v6 to v7, and am replacing some code that we use to iterate over http sessions to get information from them for our admin screen. The VaadinSesstion.getAllSessions() code pulls info out of the http session object, and those getters will throw IllegalStateException if the session has been invalidated. While the user’s app can check for this first, it could stil be invalidated concurrently with the getAllSessions call. At least I think so. 
It happened to me in v6, so I wrapped WebApplicationContext.getApplicationContext() calls in try/catch.
You might want to add it to the javadocs that this can happen. Related issue:
http://dev.vaadin.com/ticket/8995
Cheers,
Bobby
p.s. Still working on API changes for v7, and git diff > 4k lines. Whew